truefoundry-ssh-server
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the TrueFoundry CLI (
tfy) and a helper script (tfy-api.sh) to interact with platform services. These operations are consistent with the skill's primary purpose of deploying and managing SSH servers. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
truefoundryPython package and theproxytunnelutility. These are standard dependencies for platform interaction. The documentation explicitly advises the agent to seek user confirmation before performing these installations. Container images are sourced from the vendor's official registry on AWS ECR. - [PROMPT_INJECTION]: No malicious patterns or bypass attempts were detected. The skill contains robust safety instructions for the agent, such as the mandatory requirement for user confirmation of the target workspace before deployment.
- [DATA_EXFILTRATION]: Network operations are restricted to the vendor's API endpoints and official registries. No evidence of unauthorized data transmission or exfiltration of sensitive information was found.
- [CREDENTIALS_UNSAFE]: The skill manages authentication via
TFY_API_KEY. It follows standard security practices by instructing the user to provide this key through environment variables or.envfiles rather than hardcoding credentials.
Audit Metadata