migrate-placements
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the official Adapty CLI using
npm i -g adapty@latestornpx --yes adapty@latest. This is a vendor-provided tool required for the skill's operation. - [COMMAND_EXECUTION]: The skill performs shell command execution to authenticate with Adapty and manage app resources. A provided Python script,
migrate.py, wraps these CLI commands using thesubprocess.runfunction. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as placement IDs and titles fetched from the Adapty API (Ingestion points:
migrate.py). The prompts do not include specific boundary markers or ignore-instructions for this data. The script is capable of executing shell commands and performing file I/O (Capability inventory). However, it utilizesjson.dumpsandshlex.jointo properly escape and sanitize data before it is incorporated into shell commands (Sanitization). - [DYNAMIC_EXECUTION]: The skill generates a migration plan and subsequently executes dynamically constructed shell commands for placement creation. It provides a Python snippet for the agent to iterate over the plan and execute these commands.
Audit Metadata