jetty-setup
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute
curlfor interacting with vendor APIs andpython3for parsing JSON response data. - [CREDENTIALS_UNSAFE]: The skill manages sensitive API keys for Jetty and AI providers (OpenAI/Gemini).
- It stores the Jetty API token in a local
CLAUDE.mdfile for use in subsequent sessions. - It transmits provider API keys to Jetty's servers at
dock.jetty.ioto store them in collection environment variables. - [EXTERNAL_DOWNLOADS]: The skill fetches a generated image from the
flows-api.jetty.ioAPI and saves it to the local project directory. - [PROMPT_INJECTION]: The skill processes data from external sources that could potentially contain malicious instructions.
- Ingestion points: Reads tokens from the local
CLAUDE.mdfile and status data from the Jetty API. - Boundary markers: No specific delimiters or "ignore previous instruction" warnings are used when interpolating these values.
- Capability inventory: The skill possesses
Bash(network and command execution) andWrite(filesystem access) capabilities. - Sanitization: The skill employs Python's
jsonmodule to parse structured data from API responses, which helps prevent direct execution of malicious payloads embedded in strings.
Audit Metadata