opendeploy-debug

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various opendeploy CLI commands to retrieve deployment status, service configurations, and logs. These commands are legitimate diagnostic operations for the OpenDeploy platform.
  • Evidence: opendeploy deployments logs, opendeploy services config get, opendeploy services config patch, and opendeploy context resolve in SKILL.md and reference files.
  • [COMMAND_EXECUTION]: Uses npm to verify the installation and version of the platform's official CLI package.
  • Evidence: npm list -g @opendeploydev/cli and npm view @opendeploydev/cli version in SKILL.md.
  • [DATA_EXFILTRATION]: The skill explicitly implements a redaction policy to prevent the accidental exposure of credentials or secrets while debugging.
  • Evidence: Hard rules in SKILL.md state "Do not print env values, API keys, bearer headers, bind signatures, decrypted secrets, or SSL private keys. Show key names only."
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from deployment and build logs. However, this risk is mitigated by strict instruction following and redaction rules.
  • Ingestion points: Deployment and service logs fetched via opendeploy ... logs (found in SKILL.md and references/logs.md).
  • Boundary markers: Not present.
  • Capability inventory: Configuration mutation via opendeploy services config patch (found in references/port.md and references/startup-order.md).
  • Sanitization: Instructions mandate the redaction of sensitive values and excerpts in the final report.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 07:17 AM
Security Audit — agent-trust-hub — opendeploy-debug