soybean-standard-projects
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
pnpm installandgit configto manage dependencies and configure the environment. These are standard operations for frontend project migration and engineering standardization. - [INDIRECT_PROMPT_INJECTION]: The skill processes project metadata from files like
package.jsonandtsconfig.json. While these files constitute external data, the migration logic uses them for framework detection and configuration alignment rather than direct execution of embedded instructions. - Ingestion points: Project configuration files including
package.json,tsconfig.json, andpnpm-workspace.yaml. - Boundary markers: None explicitly specified for data parsing, but the transformation is governed by strict template matching.
- Capability inventory: File system read/write, shell command execution (
pnpm,git), and project-specific CLI tools (vp,soy). - Sanitization: Not explicitly implemented as the tool is designed to operate on trusted local source code during a manual migration process.
- [REMOTE_CODE_EXECUTION]: The skill optionally suggests running
pnpm dlx --package=vite-plus@latest vp migrate, which downloads and executes the latest migration utility from the npm registry. This is a common practice for maintaining up-to-date migration logic and targets the vendor's own toolchain.
Audit Metadata