next-upgrade
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: Accesses the local package.json file to read current dependency versions. No sensitive data is transmitted to external or non-whitelisted domains.
- [EXTERNAL_DOWNLOADS]: Fetches official migration guides and documentation from nextjs.org, which is a well-known service provider.
- [COMMAND_EXECUTION]: Runs npm install and npx to perform software updates and execute official Next.js codemods, which are standard operations for development workflows.
- [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: Reads local package.json and fetches external documentation from nextjs.org. 2. Boundary markers: None. 3. Capability inventory: Executes npm install, npx, and npm run commands. 4. Sanitization: None. The risk is considered safe as the ingestion sources are official project documentation and the project's own configuration.
Audit Metadata