metabase-modular-embedding-version-upgrade
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches version-specific documentation and changelogs from
metabase.comandraw.githubusercontent.com/metabase/. These are official vendor-controlled domains used to build a change catalog for the migration. - [REMOTE_CODE_EXECUTION]: The skill uses
npm packandtarto download and inspect@metabase/embedding-sdk-reactversions from the npm registry. This process occurs in a temporary directory to compare type definitions and does not involve executing untrusted third-party scripts. While automated scans flagged a documentation URL as a remote code execution risk, analysis confirms the file is read as text for context and is sourced from a trusted vendor domain. - [COMMAND_EXECUTION]: Executes local helper scripts (
prepare.sh,read-sources.sh) and standard project maintenance commands such asnpm run typecheckto ensure the integrity of the upgraded codebase. - [DATA_EXFILTRATION]: The skill reads project configuration files (e.g.,
package.json,.env) to identify current versions and update instance configurations. No sensitive data is transmitted to unauthorized external endpoints; network activity is restricted to fetching vendor documentation and package metadata.
Audit Metadata