medusa-deploy
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a deployment assistant for Medusa v2. It follows industry best practices by recommending secure environment variable handling, database SSL configurations, and the separation of server and worker processes. All documented commands are standard for the Medusa framework, and environment variable examples use generic placeholders.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a workflow where documentation is retrieved from external sources (specifically docs.medusajs.com) using
WebSearchandWebFetch, which are then processed by an agent withBashandWritecapabilities. This configuration represents an indirect prompt injection surface; however, the risk is minimized by the use of well-known and official documentation URLs. - Ingestion points:
WebSearchandWebFetchcommands inSKILL.mdtargeting official Medusa documentation. - Boundary markers: None identified in the skill instructions.
- Capability inventory:
Bash,Write,Edit,Read,Grep,Glob,WebSearch,WebFetch. - Sanitization: None; relies on platform-level safety filters.
Audit Metadata