skills/aws-samples/sample-claude-code-plugins-for-startups/migration-azure-to-aws/Gen Agent Trust Hub
migration-azure-to-aws
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate architectural guidance and technical references for cloud migration. Its behavior aligns with the stated purpose of assisting with Azure-to-AWS transitions.
- [COMMAND_EXECUTION]: The skill includes a variety of Azure CLI ('az') and AWS CLI ('aws') commands for resource discovery, such as listing virtual machines, databases, and IAM role assignments. These are intended for the user to execute during the assessment phase of a migration.
- [EXTERNAL_DOWNLOADS]: The instructions recommend installing the 'resource-graph' extension for the Azure CLI. This is an official extension from Microsoft required for querying resources across multiple subscriptions.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection (Category 8) as it processes data from Azure CLI outputs to generate migration plans.
- Ingestion points: Output from cloud discovery commands listed in 'SKILL.md'.
- Boundary markers: Absent; the skill does not instruct the agent to use specific delimiters or ignore potentially malicious instructions embedded in resource metadata (e.g., VM names or tags).
- Capability inventory: The agent uses this data to generate infrastructure-as-code (IaC) and migration wave plans.
- Sanitization: The instructions do not specify validation or sanitization of the CLI output before processing.
Audit Metadata