render-deploy
Fail
Audited by Gen Agent Trust Hub on May 1, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADSNO_CODE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute the official Render CLI installation script. This script is retrieved from the author's official GitHub repository and executed via a shell pipe.
- Evidence:
curl -fsSL https://raw.githubusercontent.com/render-oss/cli/main/bin/install.sh | shinSKILL.md. - Context: The resource belongs to the
render-ossorganization, which corresponds to the skill's author. - [COMMAND_EXECUTION]: The skill performs various shell operations using the Render CLI and Git to manage deployments, validate configuration files, and retrieve account information.
- Evidence: Commands such as
render blueprints validate,render whoami, andgit remote -vare used throughout the deployment workflow. - [EXTERNAL_DOWNLOADS]: The skill references external URLs for downloading documentation, templates, and the CLI tool from official Render domains.
- Evidence:
https://raw.githubusercontent.com/render-oss/cli/main/bin/install.shand variousdashboard.render.comlinks. - [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it reads and interprets data from local project files to automate configuration tasks.
- Ingestion points: The agent reads local repository files such as
package.json,requirements.txt,go.mod, andPipfileto identify frameworks and build settings (described inSKILL.mdandreferences/codebase-analysis.md). - Boundary markers: Absent; the agent is instructed to directly parse contents for analysis without explicit delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill has the ability to execute shell commands (
render,git), write local files (render.yaml), and interact with the Render API via MCP tools. - Sanitization: Absent; values extracted from project files are used to generate deployment configurations and commands.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/render-oss/cli/main/bin/install.sh - DO NOT USE without thorough review
Audit Metadata