netlify-publish
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Employs
npx --yes netlify-clito perform deployments and site management. It mandates the use of the--jsonflag for all commands to ensure the agent parses structured data rather than potentially ambiguous terminal output. - [EXTERNAL_DOWNLOADS]: Fetches the
netlify-clitool from the NPM registry. This is a standard procedure for using up-to-date deployment tools from a well-known service provider. - [DATA_EXFILTRATION]: Contains strict instructions to prevent the leakage of sensitive data. It explicitly forbids the agent from displaying the
NETLIFY_AUTH_TOKENor the contents of local configuration files (e.g.,%APPDATA%\netlify\Config\config.json) within the conversation. - [PROMPT_INJECTION]: Implements a 'ticket login' flow that redirects sensitive authentication tasks (entering passwords, OAuth consent) to the user's local browser via
Start-Process, ensuring the agent never handles raw credentials or attempts to bypass security filters.
Audit Metadata