tigris-static-assets
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of official vendor-supported packages, including
@tigrisdata/clivia npm andtigris-boto3-extvia pip, to facilitate interaction with Tigris storage services. - [COMMAND_EXECUTION]: The instructions include standard shell commands for deploying assets (e.g.,
tigris cp) and framework-specific tasks such asrails assets:uploadornpm run build. These operations are consistent with the skill's stated purpose of managing asset pipelines. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process local build artifacts for upload to remote storage, creating a potential surface for indirect injection if the build process is compromised.
- Ingestion points: The skill reads from local directories such as
dist/,.next/static/, andpublic/assets/as defined inSKILL.mdand framework-specific resource files. - Boundary markers: No explicit delimiters or boundary warnings are used, as the skill targets raw static assets (CSS, JS, fonts).
- Capability inventory: The skill utilizes file system read capabilities and network write capabilities through the Tigris CLI and SDKs.
- Sanitization: The skill does not perform content sanitization on the assets before deployment, which is standard behavior for static file hosting utilities.
Audit Metadata