pnpm-deps-upgrade

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a series of shell commands including git status, git push, pnpm install, and project-defined scripts like pnpm upkg. These operations are required for the skill's primary function of dependency management.
  • [EXTERNAL_DOWNLOADS]: The skill uses pnpm install, which triggers the download of external packages from public or private registries. This is a standard and expected behavior for a package management utility.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as package.json contents, git output, and pnpm-workspace.yaml. The instructions include specific checks (e.g., verifying version changes in package.json before committing) to ensure the agent does not act based on misleading data or errors in the process.
  • [DYNAMIC_EXECUTION]: The skill uses node -p to programmatically check for the existence of scripts within package.json before attempting to run them, providing a safer alternative to blindly executing shell strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 10:39 AM