database-migration-safe
Fail
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a Python script (
validate_migration.py) and various database management CLI tools (npm,npx,sequelize,prisma) within the local shell environment. - Evidence:
python .claude/skills/database-migration-safe/scripts/validate_migration.py <migration_file> - Evidence:
npm run migration:up - [REMOTE_CODE_EXECUTION]: The skill requires the execution of an unverified Python script that is part of the skill's file structure but was not provided in the audit. This script is provided with user-controlled input as arguments. The distribution originates from a domain (
claudskills.com) that appears to be a typosquat of 'Claude' and an author identity that impersonates an official development team, which significantly increases the risk that the unverified code is malicious. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download and execution of external dependencies through Node.js package managers (
npm,npx). These operations occur without version pinning or integrity validation, creating a potential vector for supply chain attacks.
Recommendations
- AI detected serious security threats
Audit Metadata