okteto-onboarding
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or critical security vulnerabilities were detected. The skill automates legitimate development workflows using official vendor tools and follows a transparent process for creating and validating project configurations.\n- [PROMPT_INJECTION]: The skill analyzes untrusted repository files (e.g.,
package.json,docker-compose.yml,Dockerfile) to generate configuration. While this creates a theoretical surface for indirect prompt injection, it is the intended functionality of an onboarding tool.\n - Ingestion points: Processes project artifacts including
docker-compose.yml, Helm charts, Kubernetes manifests, and language-specific manifests (package.json,go.mod,pom.xml,pyproject.toml, etc.).\n - Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore' instructions for the content of processed files.\n
- Capability inventory: Executes
okteto build,okteto deploy,git push, andgh pr createvia subprocess calls.\n - Sanitization: Absent. Content from analyzed files is used to model the project and generate the Okteto manifest without explicit escaping or validation.
Audit Metadata