vp-deps-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and process external data that could potentially contain malicious instructions designed to influence agent behavior.
- Ingestion points:
references/context7-integration.mddirects the agent to read external release notes, migration guides, and security advisories.references/deps-bot-handling.mdinvolves processing summaries and pull requests from dependency bots. - Boundary markers: The skill includes defensive instructions in
SKILL.mdandreferences/deps-bot-handling.mdto "independently verify" information rather than trusting aggregators or bot summaries, providing a logical boundary for the agent. - Capability inventory: The workflow in
SKILL.mdinvolves using repository package managers to modify local files and manifests. - Sanitization: The instructions do not define automated sanitization or filtering for the external content retrieved.
Audit Metadata