soybean-standard-projects

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands like pnpm install and git config to manage dependencies and configure the environment. These are standard operations for frontend project migration and engineering standardization.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project metadata from files like package.json and tsconfig.json. While these files constitute external data, the migration logic uses them for framework detection and configuration alignment rather than direct execution of embedded instructions.
  • Ingestion points: Project configuration files including package.json, tsconfig.json, and pnpm-workspace.yaml.
  • Boundary markers: None explicitly specified for data parsing, but the transformation is governed by strict template matching.
  • Capability inventory: File system read/write, shell command execution (pnpm, git), and project-specific CLI tools (vp, soy).
  • Sanitization: Not explicitly implemented as the tool is designed to operate on trusted local source code during a manual migration process.
  • [REMOTE_CODE_EXECUTION]: The skill optionally suggests running pnpm dlx --package=vite-plus@latest vp migrate, which downloads and executes the latest migration utility from the npm registry. This is a common practice for maintaining up-to-date migration logic and targets the vendor's own toolchain.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 05:04 PM