solo-deploy
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill utilizes plan-driven deployment by reading project plan files (e.g., docs/plan//plan.md) and executing instructions found within as primary directives. This ingestion of untrusted local data into a shell execution context represents an injection risk. There are no boundary markers or sanitization steps mentioned for these external instructions. The skill possesses extensive capabilities including file writing and network access through various CLIs. Ingestion points: docs/plan//plan.md, CLAUDE.md, package.json. Boundary markers: Absent. Capability inventory: Bash, Write, Read, network access. Sanitization: Absent.
- [DYNAMIC_CONTEXT_INJECTION]: The skill employs dynamic injection to retrieve git metadata at load time using the exclamation-backtick syntax. Evidence includes calls to git branch, git status, and git log. These operations are limited to benign git status checks providing project context.
- [COMMAND_EXECUTION]: Extensive use of the Bash tool is documented for running deployment workflows and platform CLI commands. This includes potentially sensitive operations like repository creation (gh repo create) and package publishing (cargo publish), though these are aligned with the skill's primary purpose and utilize well-known services.
Audit Metadata