capacitor-app-upgrade-v6-to-v7
Warn
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes dynamic context injection (
!node -e ...) inSKILL.mdto execute a shell command automatically when the skill is accessed. This script reads and processes the localpackage.jsonfile. - [COMMAND_EXECUTION]: The skill is configured in the YAML frontmatter to allow arbitrary Node.js execution through the shell via
allowed-tools: Bash(node -e *). - [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection because it ingests data from external sources without proper sanitization.
- Ingestion points: The contents of
package.json(specifically dependency names and versions) are injected into the agent's working context under the 'Live Project Snapshot' header. - Boundary markers: There are no protective delimiters or instructions to the agent to treat the injected package data as untrusted content.
- Capability inventory: The skill possesses the capability to execute shell commands and modify project files through the
Bashtool. - Sanitization: The Node.js script used to extract package info does not perform any validation or escaping of the strings found in
package.json, allowing a malicious file to include instructions disguised as package names (e.g.,@capacitor/core": "7.0.0; ignore previous instructions...").
Audit Metadata