migrate-placements

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the official Adapty CLI using npm i -g adapty@latest or npx --yes adapty@latest. This is a vendor-provided tool required for the skill's operation.
  • [COMMAND_EXECUTION]: The skill performs shell command execution to authenticate with Adapty and manage app resources. A provided Python script, migrate.py, wraps these CLI commands using the subprocess.run function.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as placement IDs and titles fetched from the Adapty API (Ingestion points: migrate.py). The prompts do not include specific boundary markers or ignore-instructions for this data. The script is capable of executing shell commands and performing file I/O (Capability inventory). However, it utilizes json.dumps and shlex.join to properly escape and sanitize data before it is incorporated into shell commands (Sanitization).
  • [DYNAMIC_EXECUTION]: The skill generates a migration plan and subsequently executes dynamically constructed shell commands for placement creation. It provides a Python snippet for the agent to iterate over the plan and execute these commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 02:49 PM