super-pm-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to run Git commands and a helper script (scripts/package-root.sh). These operations are correctly scoped to the skill's detected installation directory using the-Cflag to ensure they do not affect the user's own project files. - [EXTERNAL_DOWNLOADS]: The skill performs
git fetchto download metadata and updates from its remote repository. This is expected functionality for a skill designed to manage its own lifecycle. - [SAFE]: The skill implements robust security patterns, including verifying its installation root by checking for marker files (
VERSION,skills/INDEX.md) and ensuring it is within a valid Git repository. It enforces human-in-the-loop authorization by requiring user confirmation before performing merges and only allows fast-forward merges to prevent accidental conflicts.
Audit Metadata