upgrade-engine
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill defines standard software engineering procedures for Ruby on Rails engine maintenance and cross-version compatibility.
- [EXTERNAL_DOWNLOADS]: The example CI configuration in assets/ci_matrix.yml references official GitHub Actions (actions/checkout and ruby/setup-ruby) for checking out code and setting up the Ruby environment. These references use pinned commit SHAs, which is a recommended security practice for maintaining supply chain integrity.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions involve reading and processing Rails source code and configuration files. While this constitutes an ingestion of external data (ingestion points: gemspecs, engine.rb, routes.rb), the skill lacks dangerous tools or network exfiltration capabilities (capability inventory: bundle exec rake, bundle exec rspec) that could be abused through this surface. Boundary markers and explicit sanitization are not required for this instructional use case.
Audit Metadata