truefoundry-onboard

Pass

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the truefoundry Python package (v0.5.0) from the standard package registry using pip or uv. This is the official CLI tool provided by the author.
  • [COMMAND_EXECUTION]: The skill runs shell commands to check the tfy CLI version and perform interactive login via tfy login. It also executes a short Python snippet to check the status of local configuration files.
  • [DATA_EXFILTRATION]: The skill reads ~/.truefoundry/credentials.json to verify if the user is already logged in. This check is limited to confirming the presence of a host and token for local state management; no sensitive credentials are sent to external servers.
  • [PROMPT_INJECTION]: The skill accepts a tenant URL from the user and uses it as an argument in a shell command. While this represents an indirect injection surface, the use of quotes and the specific context of configuring the vendor's own CLI makes it a standard operational pattern.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 23, 2026, 05:53 PM
Security Audit — agent-trust-hub — truefoundry-onboard