skills/metabase/agent-skills/metabase-modular-embedding-to-modular-embedding-sdk-upgrade/Gen Agent Trust Hub
metabase-modular-embedding-to-modular-embedding-sdk-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the official
@metabase/embedding-sdk-reactpackage usingnpm packand fetches documentation fromhttps://www.metabase.com. These are recognized as official resources from the vendor. - [COMMAND_EXECUTION]: The skill executes shell scripts (
prepare.sh,read-sources.sh) to extract SDK type definitions and uses the project's package manager (npm,yarn, orpnpm) to install the new SDK dependency. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by reading React source files (
.jsx,.tsx,.js,.ts) to perform code migrations. - Ingestion points: Source files identified during the 'Project Scan' (Step 1) are read in Step 4.
- Boundary markers: The instructions do not specify explicit boundary markers or 'ignore' instructions for the content of the ingested source files.
- Capability inventory: The skill has capabilities to
WriteandEditfiles, and executeBashcommands (npm installation). - Sanitization: The skill performs structured mapping of web component tags and attributes but lacks explicit sanitization for other content within the ingested files.
Audit Metadata