validation-testing

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Executes a setup script (setup.sh) and various AST validation and transformation tools (ast-tool.ts) located in a relative directory. These scripts are part of the nextjs-migration-toolkit package intended for use with this skill.
  • [COMMAND_EXECUTION]: Runs standard project build and test commands (npx next build, npm test) to verify the migration status.
  • [DYNAMIC_EXECUTION]: Loads and executes local TypeScript files (ast-tool.ts) using npx tsx and shell scripts (setup.sh) via bash. The execution targets local files within the migration toolkit directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes external project source code to perform migration validation, which represents an attack surface for indirect instructions embedded in the code being scanned.
  • Ingestion points: Project files and application directories processed by the ast-tool.ts in SKILL.md.
  • Boundary markers: No specific delimiters or warnings for embedded instructions were found in the skill logic.
  • Capability inventory: Shell script execution, Node.js script execution via npx, build system execution, and file system writes for report generation.
  • Sanitization: No explicit sanitization or filtering of the ingested source code content is described in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 01:59 PM