truefoundry-docs
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions and automated scripts to download and install the official TrueFoundry CLI package (
truefoundry==0.5.0) from standard package registries. These downloads are directed toward the vendor's own verified tools required for the skill's functionality. - [COMMAND_EXECUTION]: Executes system commands such as
curl,pip, andtfyto fetch documentation, manage tool installations, and interact with the platform API. The included scripttfy-api.shimplements security validations to prevent path traversal and ensure authorized request methods. - [PROMPT_INJECTION]: The skill features functionality to fetch and summarize documentation from
truefoundry.com. While this represents an indirect prompt injection surface, the ingestion is limited to the vendor's official documentation domain. - Ingestion points: Documentation URLs in
SKILL.mdfetched viacurl. - Boundary markers: The agent is instructed to summarize the content, though explicit delimiters are not shown in the raw commands.
- Capability inventory: Command execution (
Bash), CLI operations (tfy), and REST API interaction. - Sanitization: The skill relies on the trusted nature of the vendor's documentation site.
Audit Metadata