insforge-cli
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references an installation script for Fly.io (https://fly.io/install.sh) which is executed by piping it to a shell command. This is used to install local dependencies for backend compute services and originates from a well-known technology provider.
- [COMMAND_EXECUTION]: Instructs the agent to execute various infrastructure management tasks using the npx @insforge/cli tool. These include SQL execution, edge function deployment, and containerized service management, which are legitimate operations for a developer tool.
- [CREDENTIALS_UNSAFE]: Documents the storage of authentication tokens in ~/.insforge/credentials.json and the use of environment variables for non-interactive login. This represents standard CLI authentication behavior rather than a security vulnerability, and the skill includes explicit warnings against exposing API keys in frontend code.
Audit Metadata