capacitor-app-upgrades
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using
npmandnpxto install packages and perform project migrations (npx cap migrate). These are standard operations for managing Capacitor mobile projects. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download official Capacitor packages and Gradle distributions from
services.gradle.org. These sources are well-known and official infrastructure for the respective technologies. - [INDIRECT_PROMPT_INJECTION]: The skill reads and processes external files such as
package.jsonandvariables.gradleto identify the current project state. This data ingestion creates a surface where a maliciously crafted project file could attempt to influence the upgrade sequence. Ingestion points:package.jsoninSKILL.md,variables.gradlein reference files. Boundary markers: None. Capability inventory: Shell command execution vianpmandnpx. Sanitization: None.
Audit Metadata