migrate-placements

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions in SKILL.md perform global installation of the adapty package using npm or execution via npx. These are official vendor-supplied tools necessary for placement migration and represent legitimate resource usage.
  • [COMMAND_EXECUTION]: The helper script references/migrate.py uses subprocess.run to interact with the Adapty CLI. The script implements safe command construction using shlex and programmatically handles CLI output for automated inventory management.
  • [PROMPT_INJECTION]: The setup logic in SKILL.md utilizes standard shell redirection (>/dev/null 2>&1) to suppress logs during initial environment checks. While this pattern can be used for concealment, in this context it is a standard practice for silent dependency verification and is accompanied by explicit status checks.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests structured data from CLI outputs and local JSON ledger files. The migrate.py script performs explicit type checking and schema validation at ingestion points to ensure data integrity and prevent injection via manipulated external responses.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 08:58 AM
Security Audit — agent-trust-hub — migrate-placements