capacitor-plugin-upgrades
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project files to determine versions and apply changes.
- Ingestion points: Reads
package.json,android/build.gradle,definitions.ts,.podspec,Package.swift, andPodfilefrom the local workspace. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are provided when processing these files.
- Capability inventory: The skill executes
npm install,npx, and file system write operations across multiple scripts. - Sanitization: No sanitization or validation of the ingested file content is performed before logic is applied.
- [REMOTE_CODE_EXECUTION]: Executes official migration tools from the npm registry.
- Execution patterns: Uses
npxto download and run migration scripts from the@capacitorscope (e.g.,@capacitor/plugin-migration-v7-to-v8@latest). - Source analysis: The resources originate from the official Capacitor and Ionic Team organizations.
- [COMMAND_EXECUTION]: Runs standard development lifecycle commands to synchronize the project.
- Operations: Executes
npm installandnpx cap syncto finalize upgrades and synchronize native platforms. - [EXTERNAL_DOWNLOADS]: Fetches external resources and configurations during the upgrade process.
- Gradle distributions: Updates
gradle-wrapper.propertiesto download specific Gradle versions fromservices.gradle.org. - Swift Package Manager: References the
capacitor-swift-pmrepository from theionic-teamGitHub organization.
Audit Metadata