upgrading-emdash

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx upgrade-emdash@latest to download and execute the vendor's official upgrade utility from the NPM registry.
  • [COMMAND_EXECUTION]: Shell commands are used for project maintenance, including running the upgrade tool, tests, and build scripts. These are standard operations for the intended use case.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and act upon instructions found in .emdash/UPGRADE.md, a file generated by the upgrade tool containing changelogs.
  • Ingestion points: .emdash/UPGRADE.md file (SKILL.md).
  • Boundary markers: None specified for the markdown content.
  • Capability inventory: Execution of project build/test scripts and the npx upgrade-emdash command.
  • Sanitization: No specific sanitization logic is described for the generated changelog content.
  • [SAFE]: The instructions include robust safety protocols, such as requiring explicit user permission before migrations and mandating restorable database backups before proceeding with deployments.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 10:43 PM