storybook-upgrade

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill directs the agent to fetch documentation from https://storybook.js.org/docs/releases/upgrading.md. This is the official documentation site for the Storybook project.
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run npx storybook@next upgrade. This command downloads and executes the Storybook CLI tool from the NPM registry at runtime.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command using npx to perform the upgrade process. This is a standard and expected operation for the vendor's own tooling.
  • [INDIRECT_PROMPT_INJECTION]: The agent is instructed to read external content from a web page in its entirety. This creates an attack surface where instructions embedded in the documentation could influence the agent's downstream actions.
  • Ingestion points: https://storybook.js.org/docs/releases/upgrading.md (referenced in SKILL.md)
  • Boundary markers: None present
  • Capability inventory: The agent has the capability to execute shell commands (via npx)
  • Sanitization: No sanitization of the external content is mentioned
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 01:01 AM