objectstack-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various system utilities such as
grep,git,mkdir, andtsc, along with the vendor's command-line toolos. These are used to inspect project state, manage version control, and run the migration logic on local metadata files. - [DYNAMIC_EXECUTION]: Inline JavaScript snippets are executed using
node -eandnode -p. These scripts perform benign tasks like readingpackage.jsonversions and processing JSON data generated during the migration process. - [INDIRECT_PROMPT_INJECTION]: The skill processes local project files and code which could theoretically contain malicious instructions. This risk is mitigated by the skill's design, which mandates human review of a generated
REPORT.mdand uses strict schema validation (os validate) to ensure metadata integrity.
Audit Metadata