netlify-config

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The CHANGELOG.md file records that the skill workflow was imported from Netlify's official GitHub repository.- [INDIRECT_PROMPT_INJECTION]: The skill documents a pattern using sed to inject environment variables into the netlify.toml file during the build process. This interpolation of environment variables into configuration files creates an attack surface where maliciously crafted variable values could lead to configuration injection or command execution.
  • Ingestion points: Environment variable interpolation in the build.command example in SKILL.md.
  • Boundary markers: None identified in the provided examples.
  • Capability inventory: Shell command execution via build.command and ignore settings.
  • Sanitization: No sanitization or validation of the environment variables is documented.- [DYNAMIC_EXECUTION]: The skill documents the ignore setting, which allows for the execution of arbitrary shell commands or Node.js scripts at runtime to determine build behavior based on file changes.- [COMMAND_EXECUTION]: The documentation includes several examples of shell commands for managing environment variables via the Netlify CLI and performing file manipulations during the build process using tools like sed and git.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:52 AM
Security Audit — agent-trust-hub — netlify-config