capacitor-plugin-upgrade-v4-to-v5
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes dynamic context injection (
!\command``) to run shell commands automatically when the skill is accessed. These commands are project-specific discovery tools. - A Node.js snippet parses the local
package.jsonto identify Capacitor-related dependencies and versions. - A
findcommand maps the project structure to locate iOS, Android, and example application directories. - These actions are contained within the local development environment and do not perform network exfiltration or access sensitive user paths like SSH or AWS configurations.
- [PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection by ingesting metadata from the project being analyzed.
- Ingestion points: Project data from
package.jsonis injected directly into the agent's context via the snapshot command inSKILL.md. - Boundary markers: None. The output is interpolated directly into the instructions.
- Capability inventory: The agent is permitted to execute
node -eandfindcommands via the Bash tool as defined in the skill's allowed-tools. - Sanitization: None. The skill assumes the project metadata is trusted.
- While a malicious
package.jsoncould attempt to influence the agent via the package name or version fields, the risk is limited to the local environment and the specific context of performing an upgrade.
Audit Metadata