metabase-modular-embedding-to-modular-embedding-sdk-upgrade

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the official @metabase/embedding-sdk-react package using npm pack and fetches documentation from https://www.metabase.com. These are recognized as official resources from the vendor.
  • [COMMAND_EXECUTION]: The skill executes shell scripts (prepare.sh, read-sources.sh) to extract SDK type definitions and uses the project's package manager (npm, yarn, or pnpm) to install the new SDK dependency.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by reading React source files (.jsx, .tsx, .js, .ts) to perform code migrations.
  • Ingestion points: Source files identified during the 'Project Scan' (Step 1) are read in Step 4.
  • Boundary markers: The instructions do not specify explicit boundary markers or 'ignore' instructions for the content of the ingested source files.
  • Capability inventory: The skill has capabilities to Write and Edit files, and execute Bash commands (npm installation).
  • Sanitization: The skill performs structured mapping of web component tags and attributes but lacks explicit sanitization for other content within the ingested files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 04:52 AM