infer-upgrade
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard shell commands (
npm,npx,grep,sed,stat) to determine installed versions and perform updates. These operations are consistent with the skill's primary function of package management. - [EXTERNAL_DOWNLOADS]: Fetches official updates for
@inferevents/sdkand@inferevents/mcpfrom the npm registry. It also downloads skill definitions from the vendor's GitHub repository usingnpx skills add infer-events/skills. These operations target the vendor's own infrastructure. - [DATA_EXFILTRATION]: Reads local configuration files (
~/.infer/config.json,.mcp.json) and writes to a version cache file (~/.infer/last-update-check.json). This data is used exclusively for local state management and update logic; no evidence of sensitive data being transmitted to third-party domains was found.
Audit Metadata