skills/ploicloud/skill/pc-deploy/Gen Agent Trust Hub

pc-deploy

Pass

Audited by Gen Agent Trust Hub on Mar 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform local environmental checks (e.g., git rev-parse) and to create a compressed archive of the project directory using the tar command for deployment purposes.
  • [EXTERNAL_DOWNLOADS]: Installation instructions guide the user to download the skill from the official repository at https://github.com/ploicloud/skill and to connect an MCP server hosted at https://ploi.cloud/mcp.
  • [DATA_EXFILTRATION]: When operating in upload mode, the skill packages project files into a temporary archive and transmits them to Ploi Cloud's infrastructure via the applications_source_upload tool. This is the intended primary function of the deployment skill.
  • [REMOTE_CODE_EXECUTION]: The skill manages the execution of build and initialization commands on the remote Ploi Cloud platform. The 'Auto-fix' feature allows the agent to dynamically modify these remote build commands based on the analysis of deployment logs.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it processes untrusted data from project files (like composer.json or .env.example) and remote deployment logs to make decisions about configuration changes.
  • Ingestion points: Local project configuration files and remote logs retrieved through the MCP interface.
  • Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard potential commands embedded within the processed log or configuration data.
  • Capability inventory: The agent has the ability to update remote build configurations (applications_build-config_update), trigger new deployments, and execute local Bash commands.
  • Sanitization: The skill lacks explicit sanitization steps for data extracted from logs before it is used to diagnose and apply fixes to the deployment configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 11, 2026, 02:19 PM