skills/carolmonroe22/lovable-cloud-to-supabase-migration/lovable-cloud-migration/Gen Agent Trust Hub
lovable-cloud-migration
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The migration instructions (SKILL.md, Phase 1 and 4) involve querying and exporting sensitive data from the source database, specifically bcrypt password hashes from the auth.users table and identity metadata. This is required for the stated purpose of preserving user credentials during migration.
- [COMMAND_EXECUTION]: The workflow (SKILL.md, Phase 8) utilizes local subprocesses including git, rsync, and gh (GitHub CLI) to manage project source code and synchronization during the migration of the frontend.
- [REMOTE_CODE_EXECUTION]: The skill facilitates the deployment of executable code to the destination Supabase environment via deploy_edge_function in SKILL.md (Phases 6 and 7). This includes a utility for storage migration and the deployment of the project's original edge functions.
- [EXTERNAL_DOWNLOADS]: The Edge Function code provided in the references (migrate-storage-function.md) uses the fetch API to download storage assets from remote URLs (the old Supabase storage instance) during the migration process.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to its extensive data ingestion.
- Ingestion points: SKILL.md (Phase 1) reads configuration files such as package.json and config.toml, and queries entire database tables for schema and data.
- Boundary markers: Absent; the agent is not instructed to use specific delimiters or ignore potential instructions within the ingested project data.
- Capability inventory: SKILL.md (database management tools, shell execution, code deployment).
- Sanitization: Absent; the skill does not specify validation or sanitization of the data before it is used in subsequent steps.
Audit Metadata