customerio-multi-env-setup
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data through environment variables which are used to configure the Customer.io client behavior and determine environment-specific logic.
- Ingestion points: Environment variables (e.g.,
CUSTOMERIO_SITE_ID,CUSTOMERIO_TRACK_API_KEY) are loaded viaprocess.envinconfig/customerio.tsandreferences/implementation-guide.mdto initialize SDK clients. - Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions are present in the provided scripts to delimit environment variable values.
- Capability inventory: The skill utilizes file modification tools (
Write,Edit), directory traversal (Glob,Grep), and shell execution viaBash(specifically fornpmandkubectloperations). It also performs Customer.io API operations including user identification, tracking, and account verification. - Sanitization: The implementation includes a
validateConfigfunction that ensures required keys are present, validates the region, and enforces environment-specific safety constraints, such as preventing dry-run mode in production. - [EXTERNAL_DOWNLOADS]: The skill interacts with the official Customer.io API for connectivity verification and event delivery.
- The CI/CD workflow in
references/implementation-guide.mdusescurlto validate credentials against the well-known service endpoint athttps://track.customer.io/api/v1/accounts. - Deployment and verification steps utilize standard
npmandnpxcommands for package management and script execution. - [COMMAND_EXECUTION]: The skill provides instructions and automation scripts that execute shell commands for deployment and testing.
SKILL.mdincludes examples usingkubectl applyfor Kubernetes configuration andnpm cifor environment setup.- Workflow examples demonstrate the use of
npx tsxto run local verification scripts.
Audit Metadata