kubernetes-flux
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's documentation provides installation commands that download and execute a script from fluxcd.io. Flux is a well-known continuous delivery tool for Kubernetes, and fluxcd.io is its official domain.
- [COMMAND_EXECUTION]: The skill uses a Node.js script to execute Flux commands via child_process.spawn. The implementation uses shell: false and does not construct shell strings from user input, which follows best practices for preventing command injection.
- [CREDENTIALS_UNSAFE]: The skill documentation includes specific instructions to mask secrets in output and verify cluster context before performing operations, addressing risks associated with handling sensitive Kubernetes data.
Audit Metadata