render-deploy

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides a command to install the official Render CLI: curl -fsSL https://raw.githubusercontent.com/render-oss/cli/main/bin/install.sh | sh. This download targets a well-known repository belonging to the service provider and represents a standard installation procedure.
  • [COMMAND_EXECUTION]: The skill directs the agent to execute various local shell commands to facilitate deployment, such as git remote -v, render blueprints validate, and npm ci. These operations are essential for the tool's primary purpose of application deployment.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-controlled codebase files, which is a potential surface for indirect injection attacks.
  • Ingestion points: Files like package.json, requirements.txt, and go.mod are analyzed in the codebase analysis phase (detailed in references/codebase-analysis.md).
  • Boundary markers: None identified; the skill treats file contents as trusted configuration data.
  • Capability inventory: The agent can perform shell command execution and manage cloud resources through MCP tools such as create_web_service and update_environment_variables.
  • Sanitization: None identified.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 03:47 PM
Security Audit — agent-trust-hub — render-deploy