upgrade

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Fetches and installs plugin updates by synchronizing the local marketplace repository with the remote source using git fetch and git reset --hard origin/main.
  • [COMMAND_EXECUTION]: Performs file system management, including creating directories, moving files with rsync, and removing old versioned directories with rm -rf within the plugin's namespace.
  • [DYNAMIC_EXECUTION]: Executes a Python snippet via a shell command to update the installed_plugins.json configuration file, interpolating version strings and Git commit hashes directly into the script body.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the CHANGELOG.md file to generate a summary for the user.
  • Ingestion points: Reads the content of CHANGELOG.md from the newly downloaded plugin directory in Step 8.
  • Boundary markers: None identified; the agent is instructed to summarize the content directly without explicit delimiters or instructions to ignore embedded commands.
  • Capability inventory: The skill has access to Bash (allowing for shell command execution), Read, and AskUserQuestion tools.
  • Sanitization: No explicit sanitization, filtering, or validation of the changelog content is performed before the agent processes and summarizes it.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 04:16 PM