website-deploy

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute npm run build and a deployment script located at $TOOLKIT_DIR/scripts/deploy.sh. This is a standard procedure for web deployments, allowing the agent to execute code defined in the project's configuration and local scripts.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads from site-config.json and processes user-provided $ARGUMENTS to determine deployment paths and configuration values without explicit boundary markers or sanitization.
  • Ingestion points: site-config.json and $ARGUMENTS variable.
  • Boundary markers: None present; data is used directly for path navigation and configuration.
  • Capability inventory: Access to shell execution (Bash) and file system modification (Write, Edit).
  • Sanitization: None implemented; the skill operates under the assumption that the local project configuration and provided directory paths are trustworthy.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 12:26 PM
Security Audit — agent-trust-hub — website-deploy