logs
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bash script (
scripts/tfy-api.sh) to perform authenticated HTTP requests to the TrueFoundry API. This script implements security measures such as HTTP method validation and path traversal prevention.- [EXTERNAL_DOWNLOADS]: The documentation references the installation of thetruefoundryPython package and account registration via official vendor CLI tools for setup purposes.- [PROMPT_INJECTION]: The skill processes untrusted application logs, presenting an indirect prompt injection surface. Ingestion points: Log content from the/api/svc/v1/logs/{workspaceId}/downloadendpoint. Boundary markers: None explicitly defined for the log data stream. Capability inventory: Network access via the TrueFoundry API wrapper (tfy-api.sh). Sanitization: No direct sanitization is performed on the log content. Note: The skill includes specific security instructions for the agent to review logs for sensitive content (secrets, PII) before outputting them, effectively mitigating the risk.
Audit Metadata