truefoundry-onboarding
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several CLI tools including
curl,pip,uv, and the TrueFoundrytfyCLI to perform platform operations and manage the local environment. - [EXTERNAL_DOWNLOADS]: The skill downloads the
truefoundryCLI from standard package registries and references container images from well-known sources including Amazon ECR, GitHub Container Registry, and NVIDIA NGC. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data such as tenant URLs and deployment manifests, which serves as an ingestion surface. The included API helper script (
scripts/tfy-api.sh) implements basic validation to prevent path traversal in API requests. - [SAFE]: The skill follows security best practices by guiding users to manage secrets using environment variables or
.envfiles, specifically advising that such files be excluded from version control systems.
Audit Metadata