rust-deployable-service
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a preflight script (
scripts/docker-preflight.sh) that automates Docker builds and execution. It allows running a smoke test command defined by theRUST_DEPLOY_SMOKE_COMMANDenvironment variable within the container, which is a standard verification technique for deployment pipelines. - [EXTERNAL_DOWNLOADS]: The documentation references official Docker images from the Rust and Debian projects. These are well-known and trusted sources used for creating reproducible build environments.
- [PROMPT_INJECTION]: The skill instructions involve analyzing local repository files like
Cargo.tomlandDockerfile. This represents a surface for indirect prompt injection if the project being analyzed contains malicious instructions. However, this ingestion is necessary for the skill's primary function. - Ingestion points: Local project files, including
Cargo.toml,Dockerfile, and configuration files (documented inSKILL.md). - Boundary markers: Absent.
- Capability inventory: Docker command execution and container interactions via the
docker-preflight.shscript. - Sanitization: Absent within the skill instructions; the agent relies on its internal safety guardrails.
- [SAFE]: The skill provides proactive security guidance, such as recommending the use of
SecretStringto prevent accidental credential leakage in logs and explicitly advising against committing production secrets to version control.
Audit Metadata