deploy-to-connect

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses various standard CLI tools and shell commands (rsconnect, uv, Rscript, quarto, grep, command -v) to detect project environments and perform deployments. These are well-defined within the scope of a deployment tool.
  • [CREDENTIALS_SAFE]: The skill explicitly instructs the agent not to search the environment for API keys (e.g., CONNECT_API_KEY, .env files) unless specifically asked by the user. It promotes the use of rsconnect login, which utilizes a browser-based OAuth flow rather than passing sensitive keys through the LLM context.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the rsconnect-python package via uv or pip, and R packages from Posit's official Package Manager (P3M). These are trusted, well-known sources for the intended development community.
  • [DATA_EXPOSURE]: There is no evidence of unauthorized data exfiltration. The network operations are limited to communicating with user-defined Posit Connect servers and official package registries.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 09:19 PM
Security Audit — agent-trust-hub — deploy-to-connect