truefoundry-ssh-server

Pass

Audited by Gen Agent Trust Hub on Apr 2, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the TrueFoundry CLI (tfy) and a helper script (tfy-api.sh) to interact with platform services. These operations are consistent with the skill's primary purpose of deploying and managing SSH servers.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the truefoundry Python package and the proxytunnel utility. These are standard dependencies for platform interaction. The documentation explicitly advises the agent to seek user confirmation before performing these installations. Container images are sourced from the vendor's official registry on AWS ECR.
  • [PROMPT_INJECTION]: No malicious patterns or bypass attempts were detected. The skill contains robust safety instructions for the agent, such as the mandatory requirement for user confirmation of the target workspace before deployment.
  • [DATA_EXFILTRATION]: Network operations are restricted to the vendor's API endpoints and official registries. No evidence of unauthorized data transmission or exfiltration of sensitive information was found.
  • [CREDENTIALS_UNSAFE]: The skill manages authentication via TFY_API_KEY. It follows standard security practices by instructing the user to provide this key through environment variables or .env files rather than hardcoding credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 2, 2026, 10:18 PM