openai-netlify-deploy

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions involve executing standard CLI tools via the Bash tool. This includes npx netlify for deployment tasks, npm install for dependency management, and git for repository linking. These commands are consistent with the skill's stated purpose of automating Netlify deployments.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx netlify to download and run the Netlify CLI, which is the official tool for a well-known service. It also facilitates project dependency installation via npm. Both actions involve downloads from official registries.
  • [CREDENTIALS_UNSAFE]: The skill mentions authentication mechanisms like NETLIFY_AUTH_TOKEN and npx netlify login. It provides secure guidance by instructing users to use placeholders for tokens and to manage secrets through the Netlify dashboard rather than committing them to version control.
  • [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading project configuration from external files to determine deployment settings.
  • Ingestion points: Project configuration is read from package.json, netlify.toml, and the output of git remote show origin (SKILL.md).
  • Boundary markers: No explicit delimiters or instructions to ignore embedded content are provided when reading these files.
  • Capability inventory: The skill uses the Bash tool to execute shell commands and the Write/Edit tools to modify files.
  • Sanitization: Project configuration values are used as arguments for deployment commands without explicit sanitization steps defined in the skill.
  • [DYNAMIC_EXECUTION]: The skill enables the execution of build scripts and plugins (e.g., @netlify/plugin-lighthouse) defined in the project's configuration files. This is a standard and expected feature of build and deployment automation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 04:26 AM
Security Audit — agent-trust-hub — openai-netlify-deploy