bx-sites-deployment
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of the
bxSitesCLI tool for deployment and packaging tasks. It provides multiple command-line examples such asbxSites deployandbxSites package, along with various flags like--entry,--target, and--destination. These are standard operational commands for the documented tool. - [DATA_EXPOSURE_AND_EXFILTRATION]: The documentation references sensitive file paths, specifically
~/.ssh/id_rsa, within JSON configuration examples for SFTP and rsync deployment targets. This is presented as a configuration option for the user to point to their own existing credentials for legitimate deployment purposes. The skill explicitly promotes security best practices by recommending the use of environment variables (suffixed withEnvVar) for API keys and tokens instead of hardcoding literal values in configuration files. - [SAFE]: All external resource references, including the
ortus-boxlang/bx-sitesrepository and associated deployment targets, are consistent with the primary purpose of the skill as a deployment reference for the BoxLang ecosystem. No obfuscation, unauthorized privilege escalation, or persistence mechanisms were detected.
Audit Metadata