migration-guidance
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
pnpm api-diff. Specifically, it runs validation checks and generates documentation files using--checkand--write-docflags. - [INDIRECT_PROMPT_INJECTION]: The skill processes external YAML data which could potentially contain malicious instructions if the source files are compromised.
- Ingestion points: YAML annotation files located under
migration/annotations/(referenced inannotations.md). - Boundary markers: The instructions include a manual verification step in
SKILL.md(step 2) to check suggested replacements against implementation and tests. - Capability inventory: The skill performs subprocess calls via
pnpmand writes to the file system atmigration/v3-to-v4.md(referenced ingeneration.md). - Sanitization: No automated sanitization or schema validation is mentioned for the ingested YAML content before the documentation generation tool processes it.
Audit Metadata