repo-modernizer

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python scripts to invoke several command-line utilities including git, npm, pnpm, yarn, bun, uv, pip, gh (GitHub CLI), and rg (ripgrep). These tools are used for repository discovery, dependency auditing, and retrieving metadata. All executions are scoped to the local project environment.
  • [EXTERNAL_DOWNLOADS]: The skill fetches package metadata and release information from trusted sources including the npm registry (registry.npmjs.org), PyPI (pypi.org), and the GitHub API. These network operations are necessary for the skill's primary function of tracking updates and security advisories.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads and summarizes external content from CHANGELOG.md files and GitHub Release notes. While this represents a potential surface for indirect prompt injection if a package maintainer includes malicious instructions in their release notes, the skill processes this text using static regex patterns to identify keywords like 'breaking' or 'deprecated', significantly limiting the exploitability of this vector.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 01:38 PM
Security Audit — agent-trust-hub — repo-modernizer