upgrading-emdash
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses
npxto execute theupgrade-emdashutility, which is a package managed by the vendor. - [EXTERNAL_DOWNLOADS]: The
upgrade-emdashpackage is retrieved from the npm registry when the upgrade command is initiated. - [COMMAND_EXECUTION]: The skill provides instructions for running project-specific commands, such as formatters, tests, and build tools, as part of the upgrade process.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and act upon instructions generated in
.emdash/UPGRADE.md. - Ingestion points:
.emdash/UPGRADE.md(file created by the upgrade tool in the local environment). - Boundary markers: None defined for the content within the generated upgrade file.
- Capability inventory: Shell command execution via
npx, file system reading, and project file modification. - Sanitization: Relies on manual inspection and agent assessment of the generated release entries before application.
Audit Metadata