upgrading-emdash

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill uses npx to execute the upgrade-emdash utility, which is a package managed by the vendor.
  • [EXTERNAL_DOWNLOADS]: The upgrade-emdash package is retrieved from the npm registry when the upgrade command is initiated.
  • [COMMAND_EXECUTION]: The skill provides instructions for running project-specific commands, such as formatters, tests, and build tools, as part of the upgrade process.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and act upon instructions generated in .emdash/UPGRADE.md.
  • Ingestion points: .emdash/UPGRADE.md (file created by the upgrade tool in the local environment).
  • Boundary markers: None defined for the content within the generated upgrade file.
  • Capability inventory: Shell command execution via npx, file system reading, and project file modification.
  • Sanitization: Relies on manual inspection and agent assessment of the generated release entries before application.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 12:43 PM