logs

Pass

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a bash script (scripts/tfy-api.sh) to perform authenticated HTTP requests to the TrueFoundry API. This script implements security measures such as HTTP method validation and path traversal prevention.- [EXTERNAL_DOWNLOADS]: The documentation references the installation of the truefoundry Python package and account registration via official vendor CLI tools for setup purposes.- [PROMPT_INJECTION]: The skill processes untrusted application logs, presenting an indirect prompt injection surface. Ingestion points: Log content from the /api/svc/v1/logs/{workspaceId}/download endpoint. Boundary markers: None explicitly defined for the log data stream. Capability inventory: Network access via the TrueFoundry API wrapper (tfy-api.sh). Sanitization: No direct sanitization is performed on the log content. Note: The skill includes specific security instructions for the agent to review logs for sensitive content (secrets, PII) before outputting them, effectively mitigating the risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 14, 2026, 08:25 PM