migration-guidance

Pass

Audited by Gen Agent Trust Hub on Oct 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using pnpm api-diff. Specifically, it runs validation checks and generates documentation files using --check and --write-doc flags.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external YAML data which could potentially contain malicious instructions if the source files are compromised.
  • Ingestion points: YAML annotation files located under migration/annotations/ (referenced in annotations.md).
  • Boundary markers: The instructions include a manual verification step in SKILL.md (step 2) to check suggested replacements against implementation and tests.
  • Capability inventory: The skill performs subprocess calls via pnpm and writes to the file system at migration/v3-to-v4.md (referenced in generation.md).
  • Sanitization: No automated sanitization or schema validation is mentioned for the ingested YAML content before the documentation generation tool processes it.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 20, 2026, 06:37 AM