netlify-deploy

Pass

Audited by Gen Agent Trust Hub on Jul 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx netlify to fetch and execute the Netlify CLI. Netlify is a well-known cloud computing company, and this is the standard method for using their deployment tools without a global installation.
  • [COMMAND_EXECUTION]: The skill facilitates the execution of shell commands such as npx netlify status, npx netlify deploy, and npm install. These commands are necessary for the primary purpose of the skill, which is to build and host web applications.
  • [PROMPT_INJECTION]: The skill exhibits an inherent attack surface for indirect prompt injection as it processes untrusted project data to determine deployment settings.
  • Ingestion points: The skill reads package.json, netlify.toml, and git remote information to configure build commands and publish directories.
  • Boundary markers: No explicit delimiters or warnings are used to instruct the agent to ignore potentially malicious instructions embedded in these project files.
  • Capability inventory: The skill has the capability to execute shell commands (npx, npm), manage environment variables, and interact with serverless databases.
  • Sanitization: The skill relies on the default parsing and execution logic of the Netlify CLI and npm.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 2, 2026, 01:52 PM