ionic-appflow-migration

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes local project files to detect current configuration and feature usage during the migration process.
  • Ingestion points: The skill reads project files such as package.json, capacitor.config.ts, and CI/CD configuration files (e.g., .github/workflows/*.yml, .gitlab-ci.yml, bitrise.yml, Jenkinsfile) to extract setup details like appId and channel in SKILL.md (Step 1).
  • Boundary markers: No explicit delimiters or instructions to ignore embedded content within these files are provided.
  • Capability inventory: The skill instructs the agent to execute shell commands via npm, npx, and claude mcp add for dependency management and tool configuration.
  • Sanitization: Data retrieved from the project files is used to populate migration steps and configuration snippets, relying on the agent's contextual processing without a dedicated sanitization step.
  • [COMMAND_EXECUTION]: The skill employs standard shell commands for project maintenance and environment setup.
  • Executes npm install and npm uninstall to transition between different SDKs.
  • Uses npx @capawesome/cli for authentication, application management, and build operations.
  • Provides instructions to add a vendor-specific MCP server using the claude mcp add command.
  • [EXTERNAL_DOWNLOADS]: The skill references and installs resources from the vendor's established infrastructure.
  • Downloads Node.js packages from the @capawesome scope via npm for project updates.
  • References an MCP server hosted at mcp.capawesome.io and provides links to official documentation and console sites at capawesome.io.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 03:45 PM