migrate-design-system
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
land.mjsscript utilizesspawnSyncandexecFileSyncto interact with the system'sgitbinary. It also supports a--bodies-checkparameter which executes shell commands viash -cto perform automated verification of network request bodies before allowing a commit. While powerful, this is an intended administrative function within the migration workflow. - [DYNAMIC_EXECUTION]: The
parity.mjsscript employs dynamicimport()to load local JavaScript modules from paths provided via command-line arguments. This mechanism is used to programmatically compare the output of legacy and new code implementation functions for parity testing. - [INDIRECT_PROMPT_INJECTION]: The skill processes repository content (code, diffs, and comments) as input. It includes regex-based scanners in
land.mjsto detect and block the inclusion of agent-specific metadata, such as worker IDs or verification verdicts, in commit messages and code comments. This acts as a safeguard against accidental or intentional inclusion of process-related data in the final product.
Audit Metadata