tuppr

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install a Helm chart from the GitHub Container Registry (oci://ghcr.io/home-operations/charts/tuppr). This is a standard software distribution method for Kubernetes controllers.
  • [INDIRECT_PROMPT_INJECTION]: The controller processes external data via TalosUpgrade and KubernetesUpgrade Custom Resource Definitions (CRDs), which constitutes a data ingestion surface.
  • Ingestion points: Resource specifications defined in SKILL.md that the agent or user creates to trigger upgrades.
  • Boundary markers: Relies on Kubernetes API structured YAML validation and namespaced resource isolation.
  • Capability inventory: Orchestrates node draining, reboots, and cluster-wide software upgrades via the Talos Linux and Kubernetes APIs.
  • Sanitization: Employs a Kubernetes admission webhook to validate and reject malformed or invalid upgrade resources.
  • [DYNAMIC_EXECUTION]: The controller utilizes Common Expression Language (CEL) for defining and executing health checks during the upgrade lifecycle.
  • Evidence: The healthChecks section in the TalosUpgrade and KubernetesUpgrade specifications uses dynamic expressions (e.g., expr: status.conditions.exists(...)) to evaluate node and cluster state.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 10:57 AM