netlify-publish
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
netlify-clipackage from the official npm registry usingnpx. This is the standard method for using the tool without pre-installation. - [COMMAND_EXECUTION]: Utilizes the Netlify CLI to perform site creation, linking, and deployment via the command line.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local file systems to locate build artifacts and entry files like
index.html. While this is a common operation for deployment tools, it involves processing data from the local environment. - Ingestion points: Local project directory structure, file names, and
package.jsoncontent (SKILL.md, auth-and-sites.md). - Boundary markers: Absent.
- Capability inventory: Shell command execution (
npx), file system writes (addingindex.htmlor_redirects), and opening web browsers (Start-Process). - Sanitization: None.
Audit Metadata