auto-updater
Warn
Audited by Gen Agent Trust Hub on Mar 14, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
scripts/check_update.shimplements an automated update mechanism that fetches code from a remote Git repository (git fetch --tags) and switches the local environment to that code (git checkout). It then proceeds to execute installation and build processes (pnpm install,pnpm build,docker build) on the newly acquired remote code. - [COMMAND_EXECUTION]: The skill requires and executes high-privilege system commands including
git,docker,docker compose,pnpm, andnpm. These commands are used to manage the host's software state and container infrastructure. - [EXTERNAL_DOWNLOADS]: The skill connects to external Git remotes to fetch tags and to package registries (NPM) to download dependencies during the update process.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by reading unvalidated data from external sources and presenting it to the agent.
- Ingestion points: Git commit messages (
git log) and theCHANGELOG.mdfile from the remote repository are read and processed. - Boundary markers: None. External content is interpolated directly into the output.
- Capability inventory: The skill has extensive host capabilities including shell access, Docker management, and package installation across
scripts/check_update.sh. - Sanitization: The script uses a Python helper to encode the data into a JSON array, but it does not perform any filtering or sanitization of the natural language content for potential instructions meant to manipulate the LLM.
- [COMMAND_EXECUTION]: The script
scripts/check_update.shspawns a Python interpreter to execute a one-liner for JSON processing of Git logs.
Audit Metadata