upgrade-larch
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local script located at '${CLAUDE_PLUGIN_ROOT}/scripts/larch.sh'. This is the primary mechanism for upgrading the plugin and is a standard administrative task for the tool.
- [INDIRECT_PROMPT_INJECTION]: The skill processes output from the 'larch.sh' script to provide feedback to the user. While it ingests external script output, the risk is minimal as the script is a local vendor-provided resource and the ingestion is limited to status reporting.
Audit Metadata