truefoundry-access-control
Pass
Audited by Gen Agent Trust Hub on Apr 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bash script (
scripts/tfy-api.sh) as a wrapper forcurlto communicate with the TrueFoundry API. The script implements checks to validate HTTP methods and prevent path traversal in API endpoints. - [EXTERNAL_DOWNLOADS]: The documentation references official TrueFoundry container images and recommends installing the
truefoundryPython package. These are verified vendor resources and do not represent a security risk. - [CREDENTIALS_UNSAFE]: Secret management follows recommended practices, using environment variables and
.envfiles for authentication. Manifests usetfy-secret://references to avoid plaintext exposure of sensitive data. - [PROMPT_INJECTION]: The instructions include security warnings and mandatory human-in-the-loop (HITL) checkpoints for all modification and deletion operations, mitigating risks from adversarial inputs.
Audit Metadata