createos-deploy
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The deployment script executes
git ls-filesto identify project files for upload. This is a standard operation for deployment tools to ensure only tracked or intended files are processed. - [DATA_EXFILTRATION]: The skill includes a filtering mechanism in
scripts/deploy.mjsusingSECRET_PATTERNSto exclude sensitive files like.env,.pem,id_rsa, andcredentials.jsonfrom the deployment package. This mitigates the risk of accidental exfiltration of local secrets to the deployment gateway. - [CREDENTIALS_UNSAFE]: The skill requires a
PRIVATE_KEYfor transaction signing. The instructions and script enforce that this key remains in the local environment or a local.envfile and is explicitly excluded from the code being uploaded to the gateway via the secret filtering logic.
Audit Metadata