starter-kit-upgrade
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several shell-based operations to facilitate the project upgrade process.
- It uses
gitfor repository management, branching, and performing byte-by-byte file comparisons. - It leverages the GitHub CLI (
gh) to retrieve commit and pull request metadata from the author's official repositories. - The
scripts/run_tests.shscript discovers and executes test commands defined within the user's project, such as those found incomposer.jsonorpackage.json(e.g.,composer test,npm run build). - [EXTERNAL_DOWNLOADS]: The
scripts/fetch_kit.shscript clones official Laravel starter kit repositories from GitHub into a local temporary directory. These downloads are restricted to the official repositories associated with the skill's author. - [REMOTE_CODE_EXECUTION]: The
scripts/reconcile_manifests.shscript runs standard package manager installation commands, includingcomposer installand various JS package manager equivalents (npm, pnpm, yarn, bun). These commands are used to synchronize dependencies and may execute installation hooks defined in the project's manifest files.
Audit Metadata