repo-modernizer
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to invoke several command-line utilities including
git,npm,pnpm,yarn,bun,uv,pip,gh(GitHub CLI), andrg(ripgrep). These tools are used for repository discovery, dependency auditing, and retrieving metadata. All executions are scoped to the local project environment. - [EXTERNAL_DOWNLOADS]: The skill fetches package metadata and release information from trusted sources including the npm registry (
registry.npmjs.org), PyPI (pypi.org), and the GitHub API. These network operations are necessary for the skill's primary function of tracking updates and security advisories. - [INDIRECT_PROMPT_INJECTION]: The skill reads and summarizes external content from
CHANGELOG.mdfiles and GitHub Release notes. While this represents a potential surface for indirect prompt injection if a package maintainer includes malicious instructions in their release notes, the skill processes this text using static regex patterns to identify keywords like 'breaking' or 'deprecated', significantly limiting the exploitability of this vector.
Audit Metadata