deploy-service
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The file
deploy.pyexecutes shell commands usingsubprocess.run(script, shell=True). This is the core functionality described in the skill's purpose. - [PROMPT_INJECTION]: The skill is subject to an indirect prompt injection surface because it builds a shell command by interpolating the
serviceandenvarguments directly without sanitization. - Ingestion points: The
serviceandenvstring arguments indeploy.py. - Boundary markers: Not present; the strings are directly formatted into the command line.
- Capability inventory: Arbitrary command execution via
subprocess.run(found indeploy.py). - Sanitization: None; the script does not validate or escape the input strings before they are used in the shell.
Audit Metadata