truefoundry-deploy
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands and scripts (tfy-api.sh, tfy-version.sh) to interact with the TrueFoundry API and CLI. These operations are intended for managing deployments and environment verification.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the TrueFoundry CLI and Python SDK from the official package registry (PyPI). It uses pinned versions (truefoundry==0.5.0) to ensure environment stability.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project data (docker-compose files, source code analysis) to automate manifest creation.
- Ingestion points: Project configuration files (docker-compose.yml, truefoundry.yaml) and source code scanning via grep.
- Boundary markers: Not explicitly defined in text segments.
- Capability inventory: Shell command execution, network requests via curl, and file system writes for manifest generation.
- Sanitization: The skill incorporates mandatory pre-flight validation and explicit user confirmation steps for sensitive deployment parameters like workspace selection.
Audit Metadata