umb-bump-version
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands including
grep,git add, andgit committo verify changes and commit them to the repository. These commands use the target version string provided by the user. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input from
$ARGUMENTSto define the target version string, creating a potential command injection surface. - Ingestion points: The
$ARGUMENTSvariable is used to receive the version string from the user. - Boundary markers: The instructions include a requirement to validate the input as a semver-like string, which acts as a filter.
- Capability inventory: The skill has the ability to read and write local files (
version.json,package.json, etc.) and execute shell commands. - Sanitization: The skill relies on the agent's ability to correctly parse and validate the version string before passing it to shell execution blocks.
Audit Metadata