copilotkit-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the migration of source code by instructing the agent to analyze the user's current codebase and fetch live documentation via MCP tools. This establishes a surface for processing untrusted external data.
- Ingestion points: Auditing the local codebase for v1 imports and utilizing the
search-docsandsearch-codetools to query live v2 documentation and source code. - Boundary markers: None explicitly defined within the skill instructions; rely on the agent's default safety filters.
- Capability inventory: The skill assumes the agent has capabilities to read and write files and modify project dependencies to complete the migration tasks.
- Sanitization: No explicit sanitization or validation of the fetched documentation content is described.
- [SAFE]: The skill provides standard documentation for upgrading software dependencies. It mentions development-only features like
agents__unsafe_dev_only, which is a standard naming convention for internal or development-specific API properties and does not represent a security risk.
Audit Metadata