rspress-v2-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: No security threats detected. The skill outlines a legitimate and standard process for software version migration.\n- [EXTERNAL_DOWNLOADS]: Fetches migration guidelines from the official Rspress documentation website, which is a well-known service for this framework.\n
- Evidence: https://rspress.rs/guide/migration/rspress-1-x (SKILL.md)\n- [COMMAND_EXECUTION]: Instructs the agent to perform dependency updates using standard command-line tools.\n
- Evidence: npx taze major --include /rspress/ -w -r (SKILL.md)\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect injection by reading and processing local project files, which is a necessary component of its intended function.\n
- Ingestion points: package.json and Rspress configuration files (e.g., rspress.config.ts) (SKILL.md).\n
- Boundary markers: Absent; the skill directs the agent to read existing project files directly.\n
- Capability inventory: File system write access and shell command execution via npx (SKILL.md).\n
- Sanitization: Not explicitly defined; the skill assumes the project files follow valid configuration schemas.
Audit Metadata