capacitor-plugin-upgrade-v8-to-v9
Warn
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: MEDIUMDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the
!commandsyntax inSKILL.mdto execute shell commands automatically when the skill is loaded by the agent. - Evidence: A Node.js script in
SKILL.mdreadspackage.jsonto extract dependency versions and check for the presence of native project files (Package.swift,.podspec). - Evidence: A
findcommand inSKILL.mdscans the local directory tree up to 3 levels deep to identify platform-specific folders (android, ios, example-app). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local project files which could be manipulated to influence agent behavior.
- Ingestion points:
package.json,android/build.gradle,.podspec, andPackage.swiftare read to determine the project state. - Boundary markers: The skill does not implement specific delimiters or warnings to ignore instructions that might be embedded in the project files being migrated.
- Capability inventory: The agent is granted access to the
Bashtool and is instructed to run package managers (npm), build tools (gradlew,xcodebuild), and a migration script vianpx. - Sanitization: No sanitization is performed on the content of the project files before the agent processes them.
- [COMMAND_EXECUTION]: The skill relies on the execution of several CLI tools to perform its primary function.
- The skill runs
npx @capacitor/plugin-migration-v8-to-v9@latest, which downloads and executes a migration utility. - Various build and dependency management commands are used, including
npm install,pod install,./gradlew clean build, andxcodebuild. - [EXTERNAL_DOWNLOADS]: The skill fetches resources from external repositories and registries.
- It downloads the migration script from the npm registry.
- It references and downloads the
capacitor-swift-pmrepository from GitHub as a dependency inPackage.swift.
Audit Metadata