unopim-install-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary purpose is to guide the agent through legitimate UnoPim installation and upgrade procedures. It provides detailed warnings about destructive commands like
unopim:install(which runsmigrate:fresh) to prevent accidental data loss. - [CREDENTIALS_UNSAFE]: While the skill discusses database credentials in the context of
BackupManager, it correctly advises using environment variables (MYSQL_PWD,PGPASSWORD) rather than passing secrets as command-line arguments. This follows industry best practices for preventing credential leakage in process lists or logs. - [COMMAND_EXECUTION]: The skill utilizes standard Laravel and UnoPim CLI tools (
php artisan,composer,docker compose). These actions are properly scoped to the intended use case of system administration and package management. - [INDIRECT_PROMPT_INJECTION]: The skill handles external inputs such as CLI flags and configuration files. It mitigates potential injection risks by referencing standard execution wrappers (
unopim-exec) and providing clear documentation on the expected structure and behavior of these inputs. - [SAFE]: The web installer routes are explicitly identified as unauthenticated by design, but they are protected by robust 'fail-closed' middleware gates that check for existing installation markers, ensuring that destructive actions cannot be performed on an already initialized system.
Audit Metadata