upgrade-engines
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified. The skill describes standard software maintenance and testing workflows for a project managed by steerlabs.\n- [EXTERNAL_DOWNLOADS]: The skill mentions that 'Antigravity' is downloaded. However, it explicitly instructs developers to verify the archive size, SHA-256 hash, and manifest, which is a standard security practice for managing external dependencies.\n- [COMMAND_EXECUTION]: Instructions include shell commands using the
pnpmpackage manager for updating and verifying engine configurations. These commands are legitimate development operations within the scope of the project.\n- [INDIRECT_PROMPT_INJECTION]: The skill involves reading project documentation and driver source code to guide engine updates, which constitutes a data ingestion surface.\n - Ingestion points:
docs/ai-engines.mdand driver files inpackages/harness-*.\n - Boundary markers: No explicit markers are defined in the instructions.\n
- Capability inventory: Shell command execution via
pnpmand environment variable configuration.\n - Sanitization: No explicit sanitization or validation of the input file content is mentioned.
Audit Metadata