truefoundry-ai-gateway

Pass

Audited by Gen Agent Trust Hub on Apr 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs a custom shell script scripts/tfy-api.sh to facilitate authenticated REST API requests to the TrueFoundry platform. It also uses the tfy command-line interface for resource configuration and application.\n- [EXTERNAL_DOWNLOADS]: Documentation within the skill provides instructions for installing the official truefoundry Python package (version 0.5.0), which is the primary tool for interacting with the vendor's platform.\n- [PROMPT_INJECTION]: The skill identifies potential attack surfaces for Indirect Prompt Injection (Category 8) and provides specific mitigations for the AI agent.\n
  • Ingestion points: The gateway can register external sources such as A2A agent cards (agent_card_url) and OpenAPI specifications (spec.url).\n
  • Boundary markers: Instructions in SKILL.md and references/manifest-schema.md require the agent to obtain explicit human confirmation before connecting to or onboarding external URLs.\n
  • Capability inventory: The skill performs sensitive operations via tfy apply and direct REST API calls through the tfy-api.sh script.\n
  • Sanitization: Guidelines emphasize verifying endpoint authenticity and using TrueFoundry's secret management for authentication headers.\n- [SAFE]: No malicious code patterns, obfuscation, or unauthorized data access were found. The skill correctly uses placeholders and secret references for sensitive configuration, ensuring that credentials are not hardcoded or exposed.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 19, 2026, 11:53 PM
Security Audit — agent-trust-hub — truefoundry-ai-gateway