deploy-nodejs-app
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill enforces data security by explicitly instructing the agent to exclude sensitive environment files (.env), credentials, and version control metadata (.git) from deployment archives.
- [SAFE]: A mandatory human-in-the-loop confirmation step is required before performing deployments that overwrite existing live websites, mitigating the risk of accidental service disruption.
- [SAFE]: The skill leverages a predefined suite of vendor-specific tools (e.g., hosting_deployJsApplication, hosting_listWebsitesV1) which scopes the agent's capabilities to intended deployment tasks and prevents arbitrary command execution.
- [SAFE]: The skill promotes secure authentication practices by advising the use of environment variables for API tokens rather than hardcoding credentials.
- [SAFE]: The inclusion of a tool to audit Node.js vulnerabilities (hosting_listNode_jsVulnerabilitiesV1) post-deployment demonstrates a proactive security posture.
- [SAFE]: While the skill ingests user project files (Category 8 surface), it implements appropriate safeguards: 1. Ingestion point: Project root files. 2. Boundary markers: Explicit instructions to exclude sensitive files. 3. Capability inventory: Limited to archiving and API-based deployment. 4. Sanitization: Automated exclusion of .env, .git, and node_modules.
Audit Metadata