dependency-updater
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill performs legitimate shell command execution to manage project dependencies.
- It utilizes language-specific package managers and CLI tools such as
npm,pip,go,cargo,bundle,mvn, anddotnet. - Scripts
scripts/check-tool.shandscripts/run-taze.share used to verify environment prerequisites and execute thetazeutility for Node.js projects. - The 'Emergency Fixes' section includes commands for clearing local caches and environments (e.g.,
rm -rf node_modules), which is standard procedure for resolving dependency corruption. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation and use of third-party developer tools from public registries.
- It recommends and installs utilities such as
taze,pip-review,pip-audit, andsafetyto facilitate updates and security scans. - Dependency updates are fetched from official language-specific registries (e.g., npm registry, PyPI).
- [SAFE]: The skill adheres to its stated purpose as a dependency management utility.
- No evidence of obfuscation, data exfiltration, or credential harvesting was found.
- The workflow requires user confirmation for major version updates, following safety best practices for automated tooling.
Audit Metadata