truefoundry-onboarding

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes several CLI tools including curl, pip, uv, and the TrueFoundry tfy CLI to perform platform operations and manage the local environment.
  • [EXTERNAL_DOWNLOADS]: The skill downloads the truefoundry CLI from standard package registries and references container images from well-known sources including Amazon ECR, GitHub Container Registry, and NVIDIA NGC.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data such as tenant URLs and deployment manifests, which serves as an ingestion surface. The included API helper script (scripts/tfy-api.sh) implements basic validation to prevent path traversal in API requests.
  • [SAFE]: The skill follows security best practices by guiding users to manage secrets using environment variables or .env files, specifically advising that such files be excluded from version control systems.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 03:58 PM