truefoundry-docs

Pass

Audited by Gen Agent Trust Hub on Apr 2, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions and automated scripts to download and install the official TrueFoundry CLI package (truefoundry==0.5.0) from standard package registries. These downloads are directed toward the vendor's own verified tools required for the skill's functionality.
  • [COMMAND_EXECUTION]: Executes system commands such as curl, pip, and tfy to fetch documentation, manage tool installations, and interact with the platform API. The included script tfy-api.sh implements security validations to prevent path traversal and ensure authorized request methods.
  • [PROMPT_INJECTION]: The skill features functionality to fetch and summarize documentation from truefoundry.com. While this represents an indirect prompt injection surface, the ingestion is limited to the vendor's official documentation domain.
  • Ingestion points: Documentation URLs in SKILL.md fetched via curl.
  • Boundary markers: The agent is instructed to summarize the content, though explicit delimiters are not shown in the raw commands.
  • Capability inventory: Command execution (Bash), CLI operations (tfy), and REST API interaction.
  • Sanitization: The skill relies on the trusted nature of the vendor's documentation site.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 2, 2026, 10:18 PM