capacitor-app-upgrade-v4-to-v5
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context execution in
SKILL.mdto run a Node.js script when the skill is loaded. The script reads the localpackage.jsonfile and extracts version information for@capacitor/packages. This is a legitimate use of the feature to provide the AI agent with necessary technical context for the upgrade task. - [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting untrusted data from the local project environment: \n
- Ingestion points: Reads the content of
package.jsonvia a shell command inSKILL.md. \n - Boundary markers: The injected snapshot does not use explicit boundary markers or instructions to ignore embedded prompts. \n
- Capability inventory: The skill allows the use of
Bashvianode -e. \n - Sanitization: The extraction script performs basic filtering by only selecting keys that start with
@capacitor/, which limits the amount of untrusted data entering the context. This is considered a low-risk surface common to development tools.
Audit Metadata