setup-external-ci-cd

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the acli.phar executable from Acquia's official GitHub repository (https://github.com/acquia/cli/releases/latest/download/acli.phar) to install the Acquia CLI.
  • [REMOTE_CODE_EXECUTION]: The downloaded acli.phar is moved to a system path (/usr/local/bin/acli) and granted execution permissions via chmod +x. This is a standard installation procedure for the vendor's primary command-line interface tool.
  • [COMMAND_EXECUTION]: The skill utilizes several local shell commands to manage the environment, including git, ssh-keyscan, composer, and acli. These commands are used as intended for repository management, authentication, and artifact deployment.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests metadata from local configuration files such as acquia-pipelines.yml and composer.json to determine the environment's PHP version. This data is used solely for configuring the CI/CD pipeline environment.
  • Ingestion points: acquia-pipelines.yml, acquia-pipelines.yaml, composer.json (referenced in SKILL.md).
  • Boundary markers: Not explicitly present, but data is processed through grep and composer config for specific keys.
  • Capability inventory: The skill performs file writes (CI configuration files), network operations (API calls via acli), and execution of local shell commands.
  • Sanitization: Not explicitly detailed for these specific metadata reads, but the usage is confined to version string extraction.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 05:28 PM