capacitor-plugin-upgrades

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and execute official migration utilities (e.g., @capacitor/plugin-migration-v7-to-v8@latest) from the public npm registry using npx. It also references official dependencies from the ionic-team GitHub organization and Gradle distribution servers.
  • [COMMAND_EXECUTION]: The instructions require the execution of common development commands like npm install, npx cap sync, and build tools to verify the upgrade process.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes local project files to determine versions and apply patches, creating a surface for indirect instructions if the project files themselves were compromised.
  • Ingestion points: Reads package.json, build.gradle, and Package.swift to identify current plugin versions.
  • Boundary markers: Absent; the skill assumes the project files are well-formed and legitimate.
  • Capability inventory: Includes the ability to execute npm install, npx commands, and write to various configuration files.
  • Sanitization: No specific sanitization or validation of the version strings or file content is performed beyond standard tool execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 02:15 PM