copilotkit-upgrade

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the migration of source code by instructing the agent to analyze the user's current codebase and fetch live documentation via MCP tools. This establishes a surface for processing untrusted external data.
  • Ingestion points: Auditing the local codebase for v1 imports and utilizing the search-docs and search-code tools to query live v2 documentation and source code.
  • Boundary markers: None explicitly defined within the skill instructions; rely on the agent's default safety filters.
  • Capability inventory: The skill assumes the agent has capabilities to read and write files and modify project dependencies to complete the migration tasks.
  • Sanitization: No explicit sanitization or validation of the fetched documentation content is described.
  • [SAFE]: The skill provides standard documentation for upgrading software dependencies. It mentions development-only features like agents__unsafe_dev_only, which is a standard naming convention for internal or development-specific API properties and does not represent a security risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 08:01 PM