gamma-upgrade-migration
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection placeholders in
SKILL.mdto executenpm listandpip freezecommands at load time. This provides the agent with the current state of the environment's dependencies to assist in the migration process. - [DYNAMIC_EXECUTION]: A manual smoke test instruction generates a Node.js script that is executed via
node -e. The script verifies connectivity to the Gamma API using the SDK and handles credentials securely via environment variables. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests environment data from command outputs into the skill context.
- Ingestion points:
Current Statesection inSKILL.md. - Boundary markers: None.
- Capability inventory:
Bash(npm:*),Bash(pip:*),Read,Write,Edit. - Sanitization: No validation or filtering is performed on the tool outputs.
Audit Metadata