turbo-builder

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill automates the use of the 'goldsky' CLI to manage the lifecycle of data pipelines and account authentication.
    • Evidence: The builder workflow in SKILL.md utilizes commands such as goldsky project list, goldsky secret list, goldsky turbo validate, goldsky turbo apply, and goldsky turbo inspect to interact with the service.
  • [DYNAMIC_EXECUTION]: The skill involves generating configuration files that contain user-defined logic, including potential code transforms, which are subsequently executed by the service.
    • Evidence: SKILL.md guides the agent to write YAML configurations (including SQL and TypeScript transforms) to disk and deploy them using the goldsky turbo apply command.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to translate high-level user goals into executable configurations, representing a managed attack surface.
    • Ingestion points: The agent takes natural language descriptions of indexing goals (e.g., specific chains, contracts, and destinations) as input in SKILL.md.
    • Boundary markers: The skill instructions provide clear demarcations for its scope, directing users to other specialized skills for diagnostics (/turbo-doctor) or syntax reference (/turbo-pipelines).
    • Capability inventory: The skill can write files to the local file system and execute CLI commands that deploy infrastructure changes.
    • Sanitization: The workflow explicitly mandates a validation check via goldsky turbo validate to ensure the integrity and correctness of the generated configuration before it is presented or applied.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 02:45 AM