netlify-config
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
CHANGELOG.mdfile records that the skill workflow was imported from Netlify's official GitHub repository.- [INDIRECT_PROMPT_INJECTION]: The skill documents a pattern usingsedto inject environment variables into thenetlify.tomlfile during the build process. This interpolation of environment variables into configuration files creates an attack surface where maliciously crafted variable values could lead to configuration injection or command execution. - Ingestion points: Environment variable interpolation in the
build.commandexample inSKILL.md. - Boundary markers: None identified in the provided examples.
- Capability inventory: Shell command execution via
build.commandandignoresettings. - Sanitization: No sanitization or validation of the environment variables is documented.- [DYNAMIC_EXECUTION]: The skill documents the
ignoresetting, which allows for the execution of arbitrary shell commands or Node.js scripts at runtime to determine build behavior based on file changes.- [COMMAND_EXECUTION]: The documentation includes several examples of shell commands for managing environment variables via the Netlify CLI and performing file manipulations during the build process using tools likesedandgit.
Audit Metadata