truefoundry-status
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs the
truefoundryCLI from the PyPI registry and references container images from official Amazon ECR and GitHub Container Registry (GHCR) repositories. - [COMMAND_EXECUTION]: The skill executes shell commands to verify system state, interact with the TrueFoundry CLI, and make authenticated API requests via
curl. - [DATA_EXFILTRATION]: The skill accesses sensitive authentication data, including the
TFY_API_KEYenvironment variable and local.envfiles, which are transmitted to the platform's API endpoint for credential verification. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The agent ingests data returned from TrueFoundry API endpoints, CLI version outputs, and command execution results.
- Boundary markers: None identified.
- Capability inventory: The skill can execute bash commands, perform network operations, and install packages via
pip. - Sanitization: The
tfy-api.shhelper script validates HTTP methods and implements checks to prevent path traversal in API requests.
Audit Metadata