ln-823-pip-upgrader
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes package manager commands including pip, poetry, and pipenv to perform dependency updates and environment synchronization.
- [COMMAND_EXECUTION]: Runs 'pytest' and dynamic Python import checks (python -c) to verify the integrity of the environment and ensure no regressions were introduced by upgrades.
- [EXTERNAL_DOWNLOADS]: Downloads updated library packages from the official Python Package Index (PyPI) and retrieves documentation from trusted sources via MCP tools.
- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection via the processing of external documentation and search results used to provide migration advice.
- Ingestion points: Data entering through migration search results (WebSearch and context7 MCP).
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the provided files.
- Capability inventory: Full subprocess execution for package management and testing utilities.
- Sanitization: No filtering or escaping of retrieved documentation content is performed before interpretation.
Audit Metadata