upgrade-js-deps

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to download and run the npm-check-updates utility from the npm registry, which is a standard and well-known service for JavaScript development.
  • [COMMAND_EXECUTION]: The skill executes various shell commands via make to install dependencies, perform type checking, build the application, and run the test suite as specified in the allowed-tools configuration.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill reads output from the npx npm-check-updates command and various make build/test scripts.
  • Boundary markers: None; the skill does not use specific delimiters or instructions to ignore instructions that might be embedded in the output of these tools.
  • Capability inventory: The skill uses Bash to execute the commands defined in the skill's frontmatter, which includes dependency installation and test execution.
  • Sanitization: There is no evidence of sanitization or validation of the text returned by the external tools before the agent processes it.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 02:10 PM