bx-sites-deployment

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the use of the bxSites CLI tool for deployment and packaging tasks. It provides multiple command-line examples such as bxSites deploy and bxSites package, along with various flags like --entry, --target, and --destination. These are standard operational commands for the documented tool.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The documentation references sensitive file paths, specifically ~/.ssh/id_rsa, within JSON configuration examples for SFTP and rsync deployment targets. This is presented as a configuration option for the user to point to their own existing credentials for legitimate deployment purposes. The skill explicitly promotes security best practices by recommending the use of environment variables (suffixed with EnvVar) for API keys and tokens instead of hardcoding literal values in configuration files.
  • [SAFE]: All external resource references, including the ortus-boxlang/bx-sites repository and associated deployment targets, are consistent with the primary purpose of the skill as a deployment reference for the BoxLang ecosystem. No obfuscation, unauthorized privilege escalation, or persistence mechanisms were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 03:14 AM
Security Audit — agent-trust-hub — bx-sites-deployment