medusa-deploy

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill serves as a deployment assistant for Medusa v2. It follows industry best practices by recommending secure environment variable handling, database SSL configurations, and the separation of server and worker processes. All documented commands are standard for the Medusa framework, and environment variable examples use generic placeholders.
  • [INDIRECT_PROMPT_INJECTION]: The skill identifies a workflow where documentation is retrieved from external sources (specifically docs.medusajs.com) using WebSearch and WebFetch, which are then processed by an agent with Bash and Write capabilities. This configuration represents an indirect prompt injection surface; however, the risk is minimized by the use of well-known and official documentation URLs.
  • Ingestion points: WebSearch and WebFetch commands in SKILL.md targeting official Medusa documentation.
  • Boundary markers: None identified in the skill instructions.
  • Capability inventory: Bash, Write, Edit, Read, Grep, Glob, WebSearch, WebFetch.
  • Sanitization: None; relies on platform-level safety filters.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 06:34 PM