tuppr
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install a Helm chart from the GitHub Container Registry (
oci://ghcr.io/home-operations/charts/tuppr). This is a standard software distribution method for Kubernetes controllers. - [INDIRECT_PROMPT_INJECTION]: The controller processes external data via TalosUpgrade and KubernetesUpgrade Custom Resource Definitions (CRDs), which constitutes a data ingestion surface.
- Ingestion points: Resource specifications defined in
SKILL.mdthat the agent or user creates to trigger upgrades. - Boundary markers: Relies on Kubernetes API structured YAML validation and namespaced resource isolation.
- Capability inventory: Orchestrates node draining, reboots, and cluster-wide software upgrades via the Talos Linux and Kubernetes APIs.
- Sanitization: Employs a Kubernetes admission webhook to validate and reject malformed or invalid upgrade resources.
- [DYNAMIC_EXECUTION]: The controller utilizes Common Expression Language (CEL) for defining and executing health checks during the upgrade lifecycle.
- Evidence: The
healthCheckssection in theTalosUpgradeandKubernetesUpgradespecifications uses dynamic expressions (e.g.,expr: status.conditions.exists(...)) to evaluate node and cluster state.
Audit Metadata