truefoundry-skills-registry

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: Invokes the official TrueFoundry CLI (tfy) for resource management. The skill explicitly enforces safety protocols, such as mandatory --dry-run and --show-diff flags followed by explicit user confirmation before any state-changing operations are performed.
  • [EXTERNAL_DOWNLOADS]: Recommends the installation of the truefoundry Python package from PyPI. This is the official client library provided by the vendor and is used for its intended purpose.
  • [DATA_EXFILTRATION]: Reads authentication tokens from the standard CLI credential path (~/.truefoundry/credentials.json) and environment variables (TFY_API_KEY). These credentials are used solely for authenticating requests to the user's TrueFoundry tenant URL as part of the skill's core functionality.
  • [SAFE]: The scripts/tfy-api.sh helper script implements security safeguards, including validating HTTP methods, preventing path traversal in API paths, and using a safe line-by-line parser for .env files to avoid accidental shell execution of untrusted content.
  • [SAFE]: The skill architecture adheres to 'Confirmation before Action' principles, particularly regarding workspace selection and manifest applications, which effectively mitigates risks associated with unintended configuration changes.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 09:28 PM
Security Audit — agent-trust-hub — truefoundry-skills-registry