opendeploy-api
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npmand the vendor-specificopendeployCLI to perform version checks and API operations. - [DATA_EXFILTRATION]: The skill leverages local credentials stored in
~/.opendeploy/auth.json. Usage is restricted to the official vendor domaindashboard.opendeploy.dev, which is consistent with the skill's primary purpose and the author's infrastructure. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external API responses.
- Ingestion points: API response data retrieved via
opendeploy api get(referenced in SKILL.md). - Boundary markers: Present; the skill explicitly instructs the agent to "Validate the response shape before acting on it" and to stop if an unrecognized structure is found.
- Capability inventory: The skill allows subprocess calls via the
opendeploy apitool forpost,put, andpatchoperations. - Sanitization: No explicit sanitization or escaping is implemented in the shell-based instructions, but boundary markers are present to guide the agent.
Audit Metadata