lovable-sync

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script scripts/migrate-workspace.py and perform Git synchronization commands such as pull and push.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads and acts upon configuration values from local project files (.lovable-agent/config.json, CLAUDE.md, and hooks/codex-hooks.json). 1. Ingestion points: .lovable-agent/config.json, CLAUDE.md, and hooks/codex-hooks.json. 2. Boundary markers: None identified. 3. Capability inventory: Git operations, shell script execution. 4. Sanitization: None described in instructions.
  • [DYNAMIC_EXECUTION]: The skill performs dynamic execution of the scripts/migrate-workspace.py script based on the existence of specific workspace directories.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 11:47 AM
Security Audit — agent-trust-hub — lovable-sync