pnpm-deps-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a series of shell commands including
git status,git push,pnpm install, and project-defined scripts likepnpm upkg. These operations are required for the skill's primary function of dependency management. - [EXTERNAL_DOWNLOADS]: The skill uses
pnpm install, which triggers the download of external packages from public or private registries. This is a standard and expected behavior for a package management utility. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as
package.jsoncontents,gitoutput, andpnpm-workspace.yaml. The instructions include specific checks (e.g., verifying version changes inpackage.jsonbefore committing) to ensure the agent does not act based on misleading data or errors in the process. - [DYNAMIC_EXECUTION]: The skill uses
node -pto programmatically check for the existence of scripts withinpackage.jsonbefore attempting to run them, providing a safer alternative to blindly executing shell strings.
Audit Metadata