truefoundry-docs
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides scripts and instructions in
references/prerequisites.mdto install the vendor-specifictruefoundryCLI and Python SDK. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external documentation from
truefoundry.comto summarize for the user. - Ingestion points:
SKILL.mdfetches documentation via curl. - Boundary markers: Instructions specify summarizing the content but do not define strict data delimiters for the fetched data.
- Capability inventory: The skill has Bash access and can perform network operations.
- Sanitization: No programmatic sanitization is applied, though instructions warn against ingesting content from untrusted third-party release pages.
- [COMMAND_EXECUTION]: Shell commands and helper scripts like
scripts/tfy-api.share used to interact with the TrueFoundry platform. The scripts include path validation to prevent traversal attacks. - [DATA_EXFILTRATION]: The skill facilitates authenticated API calls that send credentials to the platform endpoint. It correctly advises using environment variables and platform-native secret references.
Audit Metadata