using-medusa-cloud

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the Medusa Cloud CLI via npm install -g @medusajs/mcloud. This package is the official tool provided by the skill's author for interacting with their service.
  • [INDIRECT_PROMPT_INJECTION]: The skill enables the ingestion of potentially untrusted data by reading build and deployment logs using the mcloud deployments build-logs and mcloud logs commands.
  • Ingestion points: Deployment logs and build outputs are read from the cloud environment into the agent's active context (as described in debugging-deployments.md).
  • Boundary markers: The skill strictly mandates the use of the --json flag and jq for parsing to ensure output is handled as structured data rather than free-form text (as described in SKILL.md).
  • Capability inventory: The skill possesses capabilities to modify environment variables, create or delete environments, and trigger new builds.
  • Sanitization: While log content is unverified by nature, the skill relies on programmatic JSON parsing and agent-level safety guardrails to mitigate risks from malicious log content.
  • [DYNAMIC_EXECUTION]: The mcloud local build command, mentioned in debugging-deployments.md, triggers local Docker builds to replicate cloud deployment conditions. This is an intended feature for debugging code and configuration locally.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 10:39 AM