tauri-framework-upgrade

Warn

Audited by Gen Agent Trust Hub on Mar 31, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides official links to Tauri migration documentation on the well-known domain v2.tauri.app.- [EXTERNAL_DOWNLOADS]: The examples/usage.md file references a non-standard third-party package tauri-plugin-tauri-framework-upgrade. This package is not part of the official Tauri ecosystem, and its source cannot be verified.- [REMOTE_CODE_EXECUTION]: Example code snippets in examples/usage.md instruct the user or agent to import and initialize the unverified tauri-plugin-tauri-framework-upgrade package, which results in the execution of code from an external, untrusted source.- [COMMAND_EXECUTION]: The skill demonstrates the use of the invoke command to call plugin-side functionality, which executes logic on the host system via the Tauri IPC bridge.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted project data (e.g., tauri.conf.json, capabilities/default.json) and lacks specific boundary markers or sanitization procedures to prevent malicious instructions embedded in those files from influencing the agent's behavior during the upgrade process.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 31, 2026, 10:14 AM