proj-deploy

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides various shell (.sh) and PowerShell (.ps1) scripts designed to manage Docker containers and services. These scripts execute commands such as docker-compose up, docker exec, and mysqldump to perform deployment and database backup tasks. These operations are the primary function of the skill and are performed using standard system utilities.
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as a template generator that incorporates external data, such as task documentation and project names, into deployment configurations.
  • Ingestion points: The skill processes task documents and configuration files (referenced in SKILL.md).
  • Boundary markers: There are no explicit delimiters used to separate processed data from instructions.
  • Capability inventory: The skill has the ability to generate and execute shell commands and write to the local file system through its generated scripts.
  • Sanitization: Project-specific variables like PROJECT_NAME are used within the scripts without explicit validation, which is common for developer-oriented scaffolding tools.
  • [SAFE]: The external resources referenced in the Docker configurations, such as mysql:8.0, redis:7-alpine, and nginx:alpine, are official images from well-known and trusted providers. The skill also includes security headers in its Nginx templates and explicitly warns against committing sensitive .env files to version control.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 10:08 AM
Security Audit — agent-trust-hub — proj-deploy