netlify-deploy
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute
npx netlifyandnpm installcommands to build and deploy web applications. These actions are aligned with the skill's primary purpose of hosting and publishing web projects. - [EXTERNAL_DOWNLOADS]: The skill dynamically fetches the Netlify CLI using
npx. All referenced URLs and documentation links target Netlify's official domains and GitHub repositories, which are recognized as well-known and trusted services. - [DATA_EXPOSURE]: The skill documents the use of the
NETLIFY_AUTH_TOKENenvironment variable for authentication. It follows security best practices by using placeholders for sensitive values and advising users to manage secrets via the Netlify dashboard rather than hardcoding them in the project source. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect injection as it processes local configuration files like
package.jsonandnetlify.toml. Ingestion points: Reads project directory files and Git remote metadata. Boundary markers: None present. Capability inventory: Executes shell commands via build tools. Sanitization: None specified. The risk is inherent to development tools and is managed by standard platform guardrails.
Audit Metadata