validation-testing
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes a setup script (
setup.sh) and various AST validation and transformation tools (ast-tool.ts) located in a relative directory. These scripts are part of thenextjs-migration-toolkitpackage intended for use with this skill. - [COMMAND_EXECUTION]: Runs standard project build and test commands (
npx next build,npm test) to verify the migration status. - [DYNAMIC_EXECUTION]: Loads and executes local TypeScript files (
ast-tool.ts) usingnpx tsxand shell scripts (setup.sh) viabash. The execution targets local files within the migration toolkit directory. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes external project source code to perform migration validation, which represents an attack surface for indirect instructions embedded in the code being scanned.
- Ingestion points: Project files and application directories processed by the
ast-tool.tsinSKILL.md. - Boundary markers: No specific delimiters or warnings for embedded instructions were found in the skill logic.
- Capability inventory: Shell script execution, Node.js script execution via
npx, build system execution, and file system writes for report generation. - Sanitization: No explicit sanitization or filtering of the ingested source code content is described in the skill instructions.
Audit Metadata