migrate-placements
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions in
SKILL.mdperform global installation of theadaptypackage usingnpmor execution vianpx. These are official vendor-supplied tools necessary for placement migration and represent legitimate resource usage. - [COMMAND_EXECUTION]: The helper script
references/migrate.pyusessubprocess.runto interact with the Adapty CLI. The script implements safe command construction usingshlexand programmatically handles CLI output for automated inventory management. - [PROMPT_INJECTION]: The setup logic in
SKILL.mdutilizes standard shell redirection (>/dev/null 2>&1) to suppress logs during initial environment checks. While this pattern can be used for concealment, in this context it is a standard practice for silent dependency verification and is accompanied by explicit status checks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests structured data from CLI outputs and local JSON ledger files. The
migrate.pyscript performs explicit type checking and schema validation at ingestion points to ensure data integrity and prevent injection via manipulated external responses.
Audit Metadata