dependency-upgrade-safety
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a security-focused workflow for managing Android project dependencies, utilizing templates for planning and rollbacks to ensure stability.
- [EXTERNAL_DOWNLOADS]: The skill references optional companion skills from trusted sources and well-known ecosystems to facilitate official Android and maintenance patterns.
- [COMMAND_EXECUTION]: The instructions involve the use of standard, non-privileged Gradle wrapper commands for project validation and testing, following standard development practices.
- [PROMPT_INJECTION]: The skill is designed to process external project configurations and library documentation. While these are untrusted data sources, the skill serves as a safety auditing tool that mandates isolated validation and human-verifiable planning to mitigate risks associated with indirect prompt injection.
- Ingestion points: Project configuration files including libs.versions.toml, build.gradle.kts, and gradle-wrapper.properties, along with library release notes.
- Boundary markers: The workflow specifies clear boundaries by requiring upgrades to be grouped and validated independently.
- Capability inventory: Execution of standard build and test tasks via the project's Gradle wrapper.
- Sanitization: The skill directs the agent to perform logical analysis and review of the inputs rather than direct execution of input-derived content.
Audit Metadata