netlify-publish

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the netlify-cli package from the official npm registry using npx. This is the standard method for using the tool without pre-installation.
  • [COMMAND_EXECUTION]: Utilizes the Netlify CLI to perform site creation, linking, and deployment via the command line.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes local file systems to locate build artifacts and entry files like index.html. While this is a common operation for deployment tools, it involves processing data from the local environment.
  • Ingestion points: Local project directory structure, file names, and package.json content (SKILL.md, auth-and-sites.md).
  • Boundary markers: Absent.
  • Capability inventory: Shell command execution (npx), file system writes (adding index.html or _redirects), and opening web browsers (Start-Process).
  • Sanitization: None.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 10:14 AM