objectstack-upgrade

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various system utilities such as grep, git, mkdir, and tsc, along with the vendor's command-line tool os. These are used to inspect project state, manage version control, and run the migration logic on local metadata files.
  • [DYNAMIC_EXECUTION]: Inline JavaScript snippets are executed using node -e and node -p. These scripts perform benign tasks like reading package.json versions and processing JSON data generated during the migration process.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes local project files and code which could theoretically contain malicious instructions. This risk is mitigated by the skill's design, which mandates human review of a generated REPORT.md and uses strict schema validation (os validate) to ensure metadata integrity.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 01:15 PM
Security Audit — agent-trust-hub — objectstack-upgrade