Upgrade Orchestrator

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to inspect the local development environment. It runs version checks (e.g., ruby -v, bundle exec rails -v), git status inquiries, and searches project files (e.g., grep on Gemfile and CI/CD configuration files) to identify current software versions and necessary infrastructure updates.
  • [DYNAMIC_EXECUTION]: The orchestrator triggers the execution of the project's own verification suites, including RSpec tests and RuboCop linting, to ensure code quality and functionality throughout the upgrade phases. It also utilizes a custom rules engine (rules-engine.md) to apply project-specific upgrade logic.
  • [INDIRECT_PROMPT_INJECTION]: The skill's logic is influenced by the contents of project files and tool outputs which are treated as untrusted data sources.
  • Ingestion points: Reads content from Gemfile, Gemfile.lock, .ruby-version, and a local configuration file .ruby-upgrade-toolkit/rules.yml. It also processes raw output from RSpec and RuboCop runs.
  • Boundary markers: None explicitly specified for the ingestion of project file content or test outputs.
  • Capability inventory: Includes file reading/writing (Read, Edit, TodoWrite), directory traversal (Glob), and shell command execution (Bash).
  • Sanitization: The skill performs specific parsing (e.g., regex matching on version strings) to validate data from project files before using it in the upgrade logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 01:48 PM
Security Audit — agent-trust-hub — Upgrade Orchestrator