deploy-service

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The file deploy.py executes shell commands using subprocess.run(script, shell=True). This is the core functionality described in the skill's purpose.
  • [PROMPT_INJECTION]: The skill is subject to an indirect prompt injection surface because it builds a shell command by interpolating the service and env arguments directly without sanitization.
  • Ingestion points: The service and env string arguments in deploy.py.
  • Boundary markers: Not present; the strings are directly formatted into the command line.
  • Capability inventory: Arbitrary command execution via subprocess.run (found in deploy.py).
  • Sanitization: None; the script does not validate or escape the input strings before they are used in the shell.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 10:28 AM
Security Audit — agent-trust-hub — deploy-service