juicebox-upgrade-migration
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches version information from the official Juicebox API at api.juicebox.work and release metadata from GitHub (api.github.com/repos/juicebox-ai/sdk-js). These are recognized as legitimate vendor-related and well-known service sources for the skill's purpose.
- [COMMAND_EXECUTION]: Employs standard package management commands such as npm list, npm outdated, and npm install specifically for the @juicebox/sdk package. These actions are within the expected scope of a migration and upgrade tool.
- [DATA_EXFILTRATION]: Contains explicit instructions for the agent to exclude records, contacts, and secrets from output and migration receipts. It also includes directives to delete temporary fixtures and access upon completion, demonstrating good data handling practices.
- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface as it analyzes local source code and external tool outputs during the migration process. While boundary markers and sanitization are not explicitly defined, the risk is considered low and inherent to the skill's primary function of code analysis and refactoring.
Audit Metadata