truefoundry-skills-registry

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the vendor-specific tfy CLI and standard shell utilities including find, rg, and python to perform file operations and registry management.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection as it downloads and processes external Agent Skill definitions which could contain malicious instructions.
  • Ingestion points: Downloading skill bundles from the registry and processing SKILL.md body content.
  • Boundary markers: The skill explicitly instructs the user to inspect file lists, show changed content before publishing, and verify generated commands using tfy --help.
  • Capability inventory: File system inspection (find), content searching (rg), and declarative resource management via the tfy CLI tool.
  • Sanitization: Relies on manual human review and explicit user confirmation steps before performing publish or apply operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 07:10 AM