truefoundry-monitor
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and analyzes application logs to diagnose deployment failures.\n
- Ingestion points:
SKILL.mddescribes fetching logs via thelogsskill or direct API (/api/svc/v1/logs/...).\n - Boundary markers: None specified for log analysis.\n
- Capability inventory: The skill executes shell commands via
Bash(includingcurlandtfy-api.shwhich interacts with the TrueFoundry API).\n - Sanitization: The instructions guide the agent to identify failure causes from logs without explicit instructions to sanitize or ignore potential agent commands within the log text.\n- [EXTERNAL_DOWNLOADS]: The skill provides instructions to automatically install the TrueFoundry CLI.\n
- Evidence:
references/prerequisites.mdcontains a script to check for and install thetruefoundrypackage usingpiporuv. The package is version-pinned to0.5.0.\n- [COMMAND_EXECUTION]: The skill uses a helper scriptscripts/tfy-api.shto perform authenticated API requests to the TrueFoundry backend.\n - Evidence:
SKILL.mdand reference files utilizebash $TFY_API_SHfor platform interaction.
Audit Metadata