createos-deploy

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The deployment script executes git ls-files to identify project files for upload. This is a standard operation for deployment tools to ensure only tracked or intended files are processed.
  • [DATA_EXFILTRATION]: The skill includes a filtering mechanism in scripts/deploy.mjs using SECRET_PATTERNS to exclude sensitive files like .env, .pem, id_rsa, and credentials.json from the deployment package. This mitigates the risk of accidental exfiltration of local secrets to the deployment gateway.
  • [CREDENTIALS_UNSAFE]: The skill requires a PRIVATE_KEY for transaction signing. The instructions and script enforce that this key remains in the local environment or a local .env file and is explicitly excluded from the code being uploaded to the gateway via the secret filtering logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 02:17 PM
Security Audit — agent-trust-hub — createos-deploy