netlify-deploy

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute npx netlify and npm install commands to build and deploy web applications. These actions are aligned with the skill's primary purpose of hosting and publishing web projects.
  • [EXTERNAL_DOWNLOADS]: The skill dynamically fetches the Netlify CLI using npx. All referenced URLs and documentation links target Netlify's official domains and GitHub repositories, which are recognized as well-known and trusted services.
  • [DATA_EXPOSURE]: The skill documents the use of the NETLIFY_AUTH_TOKEN environment variable for authentication. It follows security best practices by using placeholders for sensitive values and advising users to manage secrets via the Netlify dashboard rather than hardcoding them in the project source.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect injection as it processes local configuration files like package.json and netlify.toml. Ingestion points: Reads project directory files and Git remote metadata. Boundary markers: None present. Capability inventory: Executes shell commands via build tools. Sanitization: None specified. The risk is inherent to development tools and is managed by standard platform guardrails.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 12:23 PM
Security Audit — agent-trust-hub — netlify-deploy