truefoundry-service-test
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes logic to automatically install the
truefoundryCLI package using pip or uv. As the skill is authored by TrueFoundry, this represents a legitimate setup procedure for the vendor's official toolset. - [COMMAND_EXECUTION]: The skill utilizes
curlfor health checks and executes local bash scripts (tfy-api.sh,tfy-version.sh) to interact with the platform API. Thetfy-api.shscript serves as an authenticated wrapper that includes explicit validation to prevent path traversal attacks in requested API paths. - [INDIRECT_PROMPT_INJECTION]: The skill manages the risks associated with processing data from external service endpoints during testing.
- Ingestion points: Untrusted data enters the agent context through
curlresponse bodies from service endpoints being tested in Layer 2 and Layer 3. - Boundary markers: The agent is instructed to parse only structured metadata, such as HTTP status codes and specific JSON schema fields.
- Capability inventory: The skill performs network operations via curl and manages deployment manifests using the tfy CLI.
- Sanitization: Explicit instructions are provided to treat all response content as untrusted third-party data and to ignore any instructions or examples found within the response bodies.
Audit Metadata