deploy-taubyte-spore-drive
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones a deployment boilerplate repository from the vendor's official GitHub account (taubyte/spore-drive-boilerplate).
- [REMOTE_CODE_EXECUTION]: The workflow involves running
npm installandnpm run displacewithin the cloned repository, which executes the deployment logic (tsx src/index.ts). These actions are standard for the deployment task described. - [COMMAND_EXECUTION]: The skill instructs the agent to perform several shell operations, including
git clone,cp,chmod, andnpmcommands to manage the deployment lifecycle. - [CREDENTIALS_UNSAFE]: The instructions guide the agent and user to configure a
.envfile containing the filesystem path to a private SSH key. While sensitive, this is a standard configuration step for automated server deployment via SSH and includes instructions for setting restrictive file permissions (chmod 600). - [INDIRECT_PROMPT_INJECTION]: The skill processes a user-provided
hosts.csvfile to identify target servers. While this is an ingestion point for external data, the risk is negligible as it is part of the user's own configuration for deployment.
Audit Metadata