version-check
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions involve querying the official npm registry and GitHub release APIs to detect package versions and available updates. These operations target well-known services and are strictly aligned with the intended purpose of the version-check skill.
- [PROMPT_INJECTION]: The skill is designed to ingest and parse external data, including CHANGELOG.md files and GitHub release notes, which could contain malicious instructions.
- Ingestion points: External content is retrieved from the npm registry, GitHub releases, and remote Hub indexes (specified in SKILL.md).
- Boundary markers: No specific delimiters or safety instructions are defined to separate untrusted external text from the agent's primary instructions.
- Capability inventory: No executable scripts are provided within the skill folder, which mitigates the risk of direct command execution; the primary capability is generating summaries for user review.
- Sanitization: There are no explicit instructions for sanitizing or escaping the content fetched from remote repositories before it is processed by the agent.
Audit Metadata