truefoundry-skills-registry
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Invokes the official TrueFoundry CLI (
tfy) for resource management. The skill explicitly enforces safety protocols, such as mandatory--dry-runand--show-diffflags followed by explicit user confirmation before any state-changing operations are performed. - [EXTERNAL_DOWNLOADS]: Recommends the installation of the
truefoundryPython package from PyPI. This is the official client library provided by the vendor and is used for its intended purpose. - [DATA_EXFILTRATION]: Reads authentication tokens from the standard CLI credential path (
~/.truefoundry/credentials.json) and environment variables (TFY_API_KEY). These credentials are used solely for authenticating requests to the user's TrueFoundry tenant URL as part of the skill's core functionality. - [SAFE]: The
scripts/tfy-api.shhelper script implements security safeguards, including validating HTTP methods, preventing path traversal in API paths, and using a safe line-by-line parser for.envfiles to avoid accidental shell execution of untrusted content. - [SAFE]: The skill architecture adheres to 'Confirmation before Action' principles, particularly regarding workspace selection and manifest applications, which effectively mitigates risks associated with unintended configuration changes.
Audit Metadata