deploy-taubyte-spore-drive

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill clones a deployment boilerplate repository from the vendor's official GitHub account (taubyte/spore-drive-boilerplate).
  • [REMOTE_CODE_EXECUTION]: The workflow involves running npm install and npm run displace within the cloned repository, which executes the deployment logic (tsx src/index.ts). These actions are standard for the deployment task described.
  • [COMMAND_EXECUTION]: The skill instructs the agent to perform several shell operations, including git clone, cp, chmod, and npm commands to manage the deployment lifecycle.
  • [CREDENTIALS_UNSAFE]: The instructions guide the agent and user to configure a .env file containing the filesystem path to a private SSH key. While sensitive, this is a standard configuration step for automated server deployment via SSH and includes instructions for setting restrictive file permissions (chmod 600).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes a user-provided hosts.csv file to identify target servers. While this is an ingestion point for external data, the risk is negligible as it is part of the user's own configuration for deployment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 08:25 PM