truefoundry-skills-registry
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill manages internal vendor workflows for TrueFoundry. No malicious patterns, obfuscation, or unauthorized data exfiltration were detected. It incorporates human-in-the-loop checkpoints for sensitive operations.
- [COMMAND_EXECUTION]: The skill utilizes the vendor-provided
tfyCLI tool and standard system utilities (find,rg,python) for legitimate repository management and file inspection tasks. These operations are restricted to the intended environment and require user interaction for destructive or publishing actions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data by downloading skill bundles from the TrueFoundry Registry. To mitigate injection risks, the instructions mandate that the user inspect downloaded files before editing and confirm all declarative changes (
tfy apply) after reviewing a diff or summary. - Ingestion points: TrueFoundry Skills Registry (SKILL.md).
- Boundary markers: Explicit instructions to "Inspect downloaded files before editing" and "Verify any generated command before running it".
- Capability inventory:
Bash(tfy*),Bash(python*),Bash(find*),Bash(rg*)(SKILL.md). - Sanitization: Manual review of file lists, summaries, and YAML diffs by the user prior to execution.
Audit Metadata