capacitor-plugin-upgrades
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and execute official migration utilities (e.g.,
@capacitor/plugin-migration-v7-to-v8@latest) from the public npm registry usingnpx. It also references official dependencies from theionic-teamGitHub organization and Gradle distribution servers. - [COMMAND_EXECUTION]: The instructions require the execution of common development commands like
npm install,npx cap sync, and build tools to verify the upgrade process. - [INDIRECT_PROMPT_INJECTION]: The skill processes local project files to determine versions and apply patches, creating a surface for indirect instructions if the project files themselves were compromised.
- Ingestion points: Reads
package.json,build.gradle, andPackage.swiftto identify current plugin versions. - Boundary markers: Absent; the skill assumes the project files are well-formed and legitimate.
- Capability inventory: Includes the ability to execute
npm install,npxcommands, and write to various configuration files. - Sanitization: No specific sanitization or validation of the version strings or file content is performed beyond standard tool execution.
Audit Metadata