update-setup
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses environment inspection commands like
nanobot --version,pip show, andpipx listto identify the current installation status and suggest appropriate update methods to the user. - [SAFE]: Implements a mandatory 'Human-in-the-Loop' workflow. The agent is strictly instructed not to write the configuration file or execute updates until the user has explicitly confirmed the installation method, dependencies, and proxy settings via a series of interactive questions.
- [COMMAND_EXECUTION]: The skill generates a secondary configuration file that facilitates updates through standard package managers (
pip,pipx,uv) orgit. These operations target the official tool package (nanobot-ai) and are standard for development environment management. - [SAFE]: The skill processes user-provided strings (like proxy URLs and source paths) and incorporates them into the generated configuration. Potential for command injection from malicious user input is mitigated by the fact that the user is configuring their own local environment, and the agent is instructed to use shell quoting for paths.
Audit Metadata