truefoundry-logs

Pass

Audited by Gen Agent Trust Hub on Apr 2, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands via the tfy-api.sh and tfy-version.sh scripts to interact with the TrueFoundry REST API and detect installed tool versions. These operations are restricted to the vendor's own platform and local environment checks.
  • [EXTERNAL_DOWNLOADS]: The references/prerequisites.md file includes logic to automatically install the official truefoundry CLI and SDK from PyPI if they are not already present in the environment. These downloads target the vendor's own verified packages.
  • [DATA_EXFILTRATION]: While the skill's primary purpose is to retrieve application logs, which can contain sensitive data, it includes explicit security warnings and success criteria that instruct the agent to review for PII or secrets and provide summarized, filtered output rather than raw data dumps.
  • [CREDENTIALS_UNSAFE]: The skill follows secure practices for credential management, directing users to provide the TFY_API_KEY via environment variables or a .env file. The provided tfy-api.sh script parses the .env file safely without using the source command.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 2, 2026, 10:18 PM