electron-chromium-upgrade
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies failed build targets and patch conflicts from command output to automate subsequent actions. This ingestion of untrusted external data (build/sync logs) could potentially be exploited by an attacker who can influence build errors to inject malicious instructions. \n
- Ingestion points: Error output from
e sync --3ande build -k 999(SKILL.md).\n - Boundary markers: None identified; the agent parses raw command output directly.\n
- Capability inventory: Execution of shell commands via
eandgit, local file system modification, and deletion of cache directories (SKILL.md).\n - Sanitization: None; the skill does not specify validation or escaping of parsed target names or error messages before using them in further commands.\n- [COMMAND_EXECUTION]: The skill requires the execution of multiple shell commands, including
git am,git rebase, and directory cleanup. While standard for the task, the dynamic construction of commands likee build -t {target}.ofrom build log output presents a potential command injection path if the input is not strictly validated.
Audit Metadata