migrate-design-system

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The land.mjs script utilizes spawnSync and execFileSync to interact with the system's git binary. It also supports a --bodies-check parameter which executes shell commands via sh -c to perform automated verification of network request bodies before allowing a commit. While powerful, this is an intended administrative function within the migration workflow.
  • [DYNAMIC_EXECUTION]: The parity.mjs script employs dynamic import() to load local JavaScript modules from paths provided via command-line arguments. This mechanism is used to programmatically compare the output of legacy and new code implementation functions for parity testing.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes repository content (code, diffs, and comments) as input. It includes regex-based scanners in land.mjs to detect and block the inclusion of agent-specific metadata, such as worker IDs or verification verdicts, in commit messages and code comments. This acts as a safeguard against accidental or intentional inclusion of process-related data in the final product.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 10:04 AM