dependency-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads code transformation scripts and changelogs from Meta's official GitHub repositories (e.g., facebook/react, reactjs/react-codemod).
- [COMMAND_EXECUTION]: Executes package management and build tools including npm, yarn, and madge to audit and update project dependencies.
- [REMOTE_CODE_EXECUTION]: Employs jscodeshift to apply remote transformation scripts from verified repositories to the local source code.
- [DYNAMIC_EXECUTION]: Includes a JavaScript migration script that performs automated find-and-replace operations across the codebase.
- [INDIRECT_PROMPT_INJECTION]: Processes external documentation and local source files to automate migrations, which could be exploited to inject instructions.
- Ingestion points: Reads local project files and external changelogs/migration guides (SKILL.md).
- Boundary markers: Absent.
- Capability inventory: File system read/write, package installation, and remote script execution.
- Sanitization: No evidence of input validation or content escaping for the data used in migration scripts.
Audit Metadata