frontend-upgrade-ops
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a Python script (
scripts/check-frontend-upgrade-facts.py) that fetches package metadata from the official npm (registry.npmjs.org) and Packagist (repo.packagist.org) registries. This is a documented feature used to verify the currency of technical facts within the skill instructions. - [DYNAMIC_EXECUTION]: The self-test script (
tests/run.sh) generates and executes local Python code via a heredoc to perform structural validation of frontmatter and link integrity. This is a standard testing pattern and does not incorporate untrusted external input. - [COMMAND_EXECUTION]: The skill provides numerous example commands for repository inventory, dependency installation, and fact verification. These utilize standard development tools such as
ddev,npm,composer,jq, andrgwithin the intended scope of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files (like
package.json) to identify version drift. While this is an ingestion point for external data, the skill uses standard parsing logic and provides security warnings to the user regarding practices like exposing environment variables.
Audit Metadata