agent-update-manager
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches version information from 'raw.githubusercontent.com/lensetek/Trading-AI-Agent-Skills/main/package.json' and performs 'git fetch' and 'git pull' operations from 'github.com/lensetek/Trading-AI-Agent-Skills'. These resources are owned by the vendor 'lensetek' and follow standard software update practices.
- [COMMAND_EXECUTION]: The script 'scripts/update_checker.py' uses 'subprocess.run' to execute 'git' commands for checking and applying updates. The commands are static and do not interpolate untrusted user input, minimizing the risk of command injection.
- [DATA_EXPOSURE]: The skill explicitly defines a protocol to ignore and protect sensitive local files such as '.env', '.db' (SQLite), and '.xlsx' (Excel reports) during the update process to prevent credential exposure or data loss.
Audit Metadata