dependency-updater

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs legitimate shell command execution to manage project dependencies.
  • It utilizes language-specific package managers and CLI tools such as npm, pip, go, cargo, bundle, mvn, and dotnet.
  • Scripts scripts/check-tool.sh and scripts/run-taze.sh are used to verify environment prerequisites and execute the taze utility for Node.js projects.
  • The 'Emergency Fixes' section includes commands for clearing local caches and environments (e.g., rm -rf node_modules), which is standard procedure for resolving dependency corruption.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation and use of third-party developer tools from public registries.
  • It recommends and installs utilities such as taze, pip-review, pip-audit, and safety to facilitate updates and security scans.
  • Dependency updates are fetched from official language-specific registries (e.g., npm registry, PyPI).
  • [SAFE]: The skill adheres to its stated purpose as a dependency management utility.
  • No evidence of obfuscation, data exfiltration, or credential harvesting was found.
  • The workflow requires user confirmation for major version updates, following safety best practices for automated tooling.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 11:53 AM