setup-external-ci-cd
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
acli.pharexecutable from Acquia's official GitHub repository (https://github.com/acquia/cli/releases/latest/download/acli.phar) to install the Acquia CLI. - [REMOTE_CODE_EXECUTION]: The downloaded
acli.pharis moved to a system path (/usr/local/bin/acli) and granted execution permissions viachmod +x. This is a standard installation procedure for the vendor's primary command-line interface tool. - [COMMAND_EXECUTION]: The skill utilizes several local shell commands to manage the environment, including
git,ssh-keyscan,composer, andacli. These commands are used as intended for repository management, authentication, and artifact deployment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests metadata from local configuration files such as
acquia-pipelines.ymlandcomposer.jsonto determine the environment's PHP version. This data is used solely for configuring the CI/CD pipeline environment. - Ingestion points:
acquia-pipelines.yml,acquia-pipelines.yaml,composer.json(referenced in SKILL.md). - Boundary markers: Not explicitly present, but data is processed through
grepandcomposer configfor specific keys. - Capability inventory: The skill performs file writes (CI configuration files), network operations (API calls via acli), and execution of local shell commands.
- Sanitization: Not explicitly detailed for these specific metadata reads, but the usage is confined to version string extraction.
Audit Metadata