opendeploy-ai-hub

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the vendor's official CLI tool (opendeploy) to manage project states, billing, and API keys. Commands are scoped to the project context and sensitive operations require explicit user approval.
  • [DATA_EXFILTRATION]: While the skill reads sensitive environment variables (e.g., OPENAI_API_KEY) and scans project source code, this is limited to its primary purpose of migrating LLM providers to the AI Hub. Data is only communicated to the official vendor endpoint at https://api.opendeploy.dev or via the local CLI.
  • [PROMPT_INJECTION]: An indirect prompt injection surface exists during the 'Migrate' phase where the skill scans untrusted project files. The skill mitigates this by enforcing a 'Show the inventory first' policy and requiring structured user approval before applying any automated code edits or environment patches.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 07:17 AM
Security Audit — agent-trust-hub — opendeploy-ai-hub