typst-toolchain-version-updater
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a local repository script
.github/scripts/update-toolchain.pyand executedocker buildx baketo verify buildability. These are standard operations for maintaining a development environment and are scoped to the project's own tools. - [INDIRECT_PROMPT_INJECTION]: The skill processes external release metadata and local configuration files, creating a potential attack surface for indirect injection.
- Ingestion points: Processes repository files (
src/typst/Dockerfile,src/typst/docker-bake.hcl) and upstream release assets from Typst and Pandoc. - Boundary markers: None explicitly defined in the instructions to isolate processed data from the agent's internal logic.
- Capability inventory: Local file system read, Python script execution, and Docker build execution.
- Sanitization: The skill instructions explicitly mandate verifying the existence of specific build artifacts (e.g., musl archives and Docker tags) before updating versions, which acts as a validation step for external inputs.
Audit Metadata