upgrade

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill synchronizes the local marketplace repository with the remote origin using git fetch and git reset --hard to retrieve new versions of the plugin files.
  • [COMMAND_EXECUTION]: Shell commands including rsync, rm, and mkdir are used to manage versioned cache directories and deploy updated plugin files.
  • [DYNAMIC_EXECUTION]: An inline Python script is generated and executed at runtime to programmatically update the installed_plugins.json file with new version metadata and installation paths.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads and processes the CHANGELOG.md from the newly downloaded version to generate a summary of changes for the user.
  • Ingestion points: CHANGELOG.md in the new cache directory
  • Boundary markers: None
  • Capability inventory: Bash, Read, AskUserQuestion
  • Sanitization: None
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 12:15 AM
Security Audit — agent-trust-hub — upgrade