opendeploy-monorepo
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill analyzes untrusted repository files to generate deployment plans, which presents an indirect prompt injection surface.
- Ingestion points: Processes configuration and manifest files including
package.json,docker-compose.yml,Procfile, and ORM/schema configuration files. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when the agent reads the content of these files.
- Capability inventory: The skill is capable of executing
npmandopendeployCLI commands and creating files (e.g., wrapper Dockerfiles) in the project directory. - Sanitization: Content extracted from analyzed repository files is not explicitly sanitized or validated before being incorporated into the deployment planning logic.
- [COMMAND_EXECUTION]: Uses global CLI tools such as
npmandopendeployto perform environment preflight checks and execute deployment plan sequences. - [EXTERNAL_DOWNLOADS]: Accesses the npm registry to perform version checks and retrieve metadata for the
@opendeploydev/clipackage.
Audit Metadata