dependency-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a structured workflow for software maintenance using standard system tools such as npm, pip, cargo, and git. Its operations are restricted to the local project environment for the purpose of upgrading dependencies.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from package registries, including package names, version strings, and changelog content.\n
- Ingestion points: Captures output from ecosystem 'outdated' commands and reads external release notes during Step 1, Step 2, and Step 5.\n
- Boundary markers: The process involves creating an intermediate batch plan for user review, but the skill does not explicitly use prompt delimiters when processing command output.\n
- Capability inventory: The skill performs package installations, regenerates lockfiles, and creates git commits during Step 4.\n
- Sanitization: The skill relies on the underlying package managers (npm, pip, cargo, etc.) to handle external metadata without additional sanitization layers.
Audit Metadata