customerio-deploy-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides code templates for serverless functions and API handlers that ingest data from request bodies and transmit it to external APIs. 1. Ingestion points: Request body processing in api/customerio/identify.ts and src/handlers/identify.ts. 2. Capability inventory: Network operations via the Customer.io client library to send data to external servers. 3. Sanitization: The templates perform existence checks but lack content validation before transmission, representing a standard surface for indirect data injection.
- [EXTERNAL_DOWNLOADS]: The CI/CD workflow examples reference official GitHub Actions from well-known cloud providers for authentication and environment configuration.
Audit Metadata