embarko-deploy

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a deployment script scripts/deploy.sh which uses standard tools like curl, tar, git, and node to package and upload the application. These operations are restricted to the application's source files and are necessary for the skill's primary function of deploying code.
  • [EXTERNAL_DOWNLOADS]: The skill downloads a viaSocket integration guide and configuration from flow.viasocket.com. This is a documented step for enabling external service integrations as part of the Embarko platform's features.
  • [DATA_EXFILTRATION]: The skill uploads the application's source code to ship.embarko.ai. While this involves sending data to an external server, it is the intended and primary purpose of the skill (deployment). The script includes explicit exclusions for sensitive files like .env and .git folders to prevent accidental exposure of secrets.
  • [CREDENTIALS_UNSAFE]: The skill manages a DEPLOY_TOKEN for authentication. The instructions explicitly direct the agent to store this token in ~/.embarko/credentials and never print it back to the user or hardcode it, following best practices for secret management.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 04:51 AM