netlify-deploy
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx netlifyto download and execute the Netlify CLI from the official NPM registry. Netlify is a well-known service, and this is the standard method for programmatic interaction with its platform. - [COMMAND_EXECUTION]: Executes shell commands to install project dependencies (e.g.,
npm install,yarn install) and run build and deployment processes. These actions are necessary for the skill's primary function of deploying web applications. - [PROMPT_INJECTION]: The skill processes project files such as
package.jsonandnetlify.tomlto determine build settings. This creates an indirect prompt injection surface where a malicious repository could contain instructions designed to influence the agent's behavior during the deployment process. - Ingestion points:
package.json,netlify.toml, and output fromgit remote show origin. - Boundary markers: No specific delimiters or warnings for embedded instructions are utilized in the instructions.
- Capability inventory:
npm install,npx netlify deploy,npx netlify init, andnpx netlify env:set(found in references/cli-commands.md). - Sanitization: No explicit sanitization of project file content or command output is described.
Audit Metadata