upgrade-js-deps
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and run thenpm-check-updatesutility from the npm registry, which is a standard and well-known service for JavaScript development. - [COMMAND_EXECUTION]: The skill executes various shell commands via
maketo install dependencies, perform type checking, build the application, and run the test suite as specified in theallowed-toolsconfiguration. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill reads output from the
npx npm-check-updatescommand and variousmakebuild/test scripts. - Boundary markers: None; the skill does not use specific delimiters or instructions to ignore instructions that might be embedded in the output of these tools.
- Capability inventory: The skill uses
Bashto execute the commands defined in the skill's frontmatter, which includes dependency installation and test execution. - Sanitization: There is no evidence of sanitization or validation of the text returned by the external tools before the agent processes it.
Audit Metadata