framework-migration-deps-upgrade
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes Python and shell scripts that execute standard developer tools for dependency management. Evidence includes:
- Invocation of
npm outdated,npm install, andnpm auditfor Node.js projects. - Invocation of
pip list --outdatedfor Python environments. - Framework-specific commands such as
ng updatefor Angular andnpx react-codemodfor React. - Git commands for branch management and rollback procedures.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill performs local audits of dependency files (
package.json,requirements.txt) to identify update opportunities. It does not perform network operations to non-standard domains or attempt to access sensitive credentials like SSH keys or cloud provider configs. - [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect injection where external data (such as package changelogs) is parsed and interpolated into the migration guides presented to the agent. This is a functional requirement for the skill's purpose of detecting breaking changes, and the scripts focus on regex-based extraction of technical keywords.
Audit Metadata