deploy
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill follows best practices for deployment automation, including local verification steps and manual confirmation gates for production environments.
- [COMMAND_EXECUTION]: The skill executes standard development and deployment commands (e.g.,
npm,aws,vercel,docker,gh). These operations are explicitly tied to the skill's primary purpose of managing application deployments and use local project configuration as the source of truth. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local project files (such as
package.jsonand logs) and interpolates them into deployment workflows. While this constitutes an attack surface, the risk is mitigated by the skill's focus on structured deployment tasks and the requirement for user confirmation before critical production actions. - Ingestion points: Reads
package.json,.env.example, deployment logs, and monitoring systems. - Boundary markers: None explicitly defined for file content.
- Capability inventory: Execution of shell scripts, deployment CLIs, and git operations.
- Sanitization: Relies on standard CLI tools and manual user confirmation for safety.
Audit Metadata