deploy-to-connect
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses various standard CLI tools and shell commands (
rsconnect,uv,Rscript,quarto,grep,command -v) to detect project environments and perform deployments. These are well-defined within the scope of a deployment tool. - [CREDENTIALS_SAFE]: The skill explicitly instructs the agent not to search the environment for API keys (e.g.,
CONNECT_API_KEY,.envfiles) unless specifically asked by the user. It promotes the use ofrsconnect login, which utilizes a browser-based OAuth flow rather than passing sensitive keys through the LLM context. - [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the
rsconnect-pythonpackage viauvorpip, and R packages from Posit's official Package Manager (P3M). These are trusted, well-known sources for the intended development community. - [DATA_EXPOSURE]: There is no evidence of unauthorized data exfiltration. The network operations are limited to communicating with user-defined Posit Connect servers and official package registries.
Audit Metadata