turbo-builder
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates the use of the 'goldsky' CLI to manage the lifecycle of data pipelines and account authentication.
- Evidence: The builder workflow in
SKILL.mdutilizes commands such asgoldsky project list,goldsky secret list,goldsky turbo validate,goldsky turbo apply, andgoldsky turbo inspectto interact with the service.
- Evidence: The builder workflow in
- [DYNAMIC_EXECUTION]: The skill involves generating configuration files that contain user-defined logic, including potential code transforms, which are subsequently executed by the service.
- Evidence:
SKILL.mdguides the agent to write YAML configurations (including SQL and TypeScript transforms) to disk and deploy them using thegoldsky turbo applycommand.
- Evidence:
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to translate high-level user goals into executable configurations, representing a managed attack surface.
- Ingestion points: The agent takes natural language descriptions of indexing goals (e.g., specific chains, contracts, and destinations) as input in
SKILL.md. - Boundary markers: The skill instructions provide clear demarcations for its scope, directing users to other specialized skills for diagnostics (
/turbo-doctor) or syntax reference (/turbo-pipelines). - Capability inventory: The skill can write files to the local file system and execute CLI commands that deploy infrastructure changes.
- Sanitization: The workflow explicitly mandates a validation check via
goldsky turbo validateto ensure the integrity and correctness of the generated configuration before it is presented or applied.
- Ingestion points: The agent takes natural language descriptions of indexing goals (e.g., specific chains, contracts, and destinations) as input in
Audit Metadata