dependency-updater
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell command execution to run package managers and specialized update tools (such as
taze,pip,go,cargo,mvn, anddotnet) for project maintenance tasks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project configuration files which could potentially contain malicious instructions.
- Ingestion points: Project dependency files including
package.json,requirements.txt,go.mod,Cargo.toml,Gemfile,pom.xml, and*.csprojas defined inSKILL.md. - Boundary markers: The skill requires individual user confirmation for all major version updates (Step 5 in the workflow), which serves as a security checkpoint.
- Capability inventory: The skill has the ability to execute system commands and modify local files through various package managers and support scripts (
scripts/run-taze.sh,scripts/check-tool.sh). - Sanitization: The instructions do not specify any validation or sanitization of the content read from dependency files before processing.
Audit Metadata