storybook-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the agent to fetch documentation from
https://storybook.js.org/docs/releases/upgrading.md. This is the official documentation site for the Storybook project. - [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run
npx storybook@next upgrade. This command downloads and executes the Storybook CLI tool from the NPM registry at runtime. - [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command using
npxto perform the upgrade process. This is a standard and expected operation for the vendor's own tooling. - [INDIRECT_PROMPT_INJECTION]: The agent is instructed to read external content from a web page in its entirety. This creates an attack surface where instructions embedded in the documentation could influence the agent's downstream actions.
- Ingestion points:
https://storybook.js.org/docs/releases/upgrading.md(referenced inSKILL.md) - Boundary markers: None present
- Capability inventory: The agent has the capability to execute shell commands (via
npx) - Sanitization: No sanitization of the external content is mentioned
Audit Metadata