opendeploy-ai-hub
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the vendor's official CLI tool (
opendeploy) to manage project states, billing, and API keys. Commands are scoped to the project context and sensitive operations require explicit user approval. - [DATA_EXFILTRATION]: While the skill reads sensitive environment variables (e.g.,
OPENAI_API_KEY) and scans project source code, this is limited to its primary purpose of migrating LLM providers to the AI Hub. Data is only communicated to the official vendor endpoint athttps://api.opendeploy.devor via the local CLI. - [PROMPT_INJECTION]: An indirect prompt injection surface exists during the 'Migrate' phase where the skill scans untrusted project files. The skill mitigates this by enforcing a 'Show the inventory first' policy and requiring structured user approval before applying any automated code edits or environment patches.
Audit Metadata