lovable-deploy
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official Lovable Model Context Protocol (MCP) server endpoint at 'https://mcp.lovable.dev' to execute deployment tasks and read tool schemas.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external project code and configuration data which serves as a potential attack surface.
- Ingestion points: The agent is instructed to scan changed code in the repository and read project configuration from '.lovable-agent/config.json'.
- Boundary markers: None explicitly defined for the ingested code content.
- Capability inventory: The skill utilizes Model Context Protocol (MCP) tool calls and browser automation for deployment operations.
- Sanitization: The instructions explicitly direct the agent to scan for secret names without exposing their actual values and to omit preview tokens or secrets from all requests, URLs, logs, and generated reports.
Audit Metadata