using-medusa-cloud
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the Medusa Cloud CLI via
npm install -g @medusajs/mcloud. This package is the official tool provided by the skill's author for interacting with their service. - [INDIRECT_PROMPT_INJECTION]: The skill enables the ingestion of potentially untrusted data by reading build and deployment logs using the
mcloud deployments build-logsandmcloud logscommands. - Ingestion points: Deployment logs and build outputs are read from the cloud environment into the agent's active context (as described in
debugging-deployments.md). - Boundary markers: The skill strictly mandates the use of the
--jsonflag andjqfor parsing to ensure output is handled as structured data rather than free-form text (as described inSKILL.md). - Capability inventory: The skill possesses capabilities to modify environment variables, create or delete environments, and trigger new builds.
- Sanitization: While log content is unverified by nature, the skill relies on programmatic JSON parsing and agent-level safety guardrails to mitigate risks from malicious log content.
- [DYNAMIC_EXECUTION]: The
mcloud local buildcommand, mentioned indebugging-deployments.md, triggers local Docker builds to replicate cloud deployment conditions. This is an intended feature for debugging code and configuration locally.
Audit Metadata