customerio-multi-env-setup

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data through environment variables which are used to configure the Customer.io client behavior and determine environment-specific logic.
  • Ingestion points: Environment variables (e.g., CUSTOMERIO_SITE_ID, CUSTOMERIO_TRACK_API_KEY) are loaded via process.env in config/customerio.ts and references/implementation-guide.md to initialize SDK clients.
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded instructions are present in the provided scripts to delimit environment variable values.
  • Capability inventory: The skill utilizes file modification tools (Write, Edit), directory traversal (Glob, Grep), and shell execution via Bash (specifically for npm and kubectl operations). It also performs Customer.io API operations including user identification, tracking, and account verification.
  • Sanitization: The implementation includes a validateConfig function that ensures required keys are present, validates the region, and enforces environment-specific safety constraints, such as preventing dry-run mode in production.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with the official Customer.io API for connectivity verification and event delivery.
  • The CI/CD workflow in references/implementation-guide.md uses curl to validate credentials against the well-known service endpoint at https://track.customer.io/api/v1/accounts.
  • Deployment and verification steps utilize standard npm and npx commands for package management and script execution.
  • [COMMAND_EXECUTION]: The skill provides instructions and automation scripts that execute shell commands for deployment and testing.
  • SKILL.md includes examples using kubectl apply for Kubernetes configuration and npm ci for environment setup.
  • Workflow examples demonstrate the use of npx tsx to run local verification scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:44 AM