dokploy-production
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill defines a defensive workflow for production changes, emphasizing the identification and protection of secrets, validation of configurations without exposing credentials, and verification of service health. It includes explicit guardrails to prevent common deployment errors and unauthorized data exposure, such as instructions to never print secret contents or publish internal services to the public proxy.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted repository files, which presents a potential surface for indirect instructions embedded in documentation or configuration files.
- Ingestion points: The agent reads
AGENTS.md, deployment documentation, and project environment files to determine deployment configuration (SKILL.md). - Boundary markers: The instructions do not specify the use of delimiters for external content, though they provide strong logical guardrails requiring the agent to verify project-specific settings before acting.
- Capability inventory: The skill utilizes
docker composevalidation,git statusinspection, and project-specific build, test, and migration scripts (SKILL.md). - Sanitization: The skill mandates strict secret masking in logs and chat, and recommends using dummy values for validation when production environment files are unavailable.
Audit Metadata