upgrading-emdash
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx upgrade-emdash@latestto download and execute the vendor's official upgrade utility from the NPM registry. - [COMMAND_EXECUTION]: Shell commands are used for project maintenance, including running the upgrade tool, tests, and build scripts. These are standard operations for the intended use case.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and act upon instructions found in
.emdash/UPGRADE.md, a file generated by the upgrade tool containing changelogs. - Ingestion points:
.emdash/UPGRADE.mdfile (SKILL.md). - Boundary markers: None specified for the markdown content.
- Capability inventory: Execution of project build/test scripts and the
npx upgrade-emdashcommand. - Sanitization: No specific sanitization logic is described for the generated changelog content.
- [SAFE]: The instructions include robust safety protocols, such as requiring explicit user permission before migrations and mandating restorable database backups before proceeding with deployments.
Audit Metadata