migrate-to-cloudcannon

Pass

Audited by Gen Agent Trust Hub on Nov 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes several bash scripts (e.g., scripts/audit-astro.sh, scripts/audit-hugo.sh) designed to automate the initial project audit phase. These scripts execute standard system commands such as find, grep, basename, wc, and cut to gather metadata about project structure, content, and configuration.
  • [COMMAND_EXECUTION]: The audit scripts use node -e to execute small JavaScript snippets for parsing package.json files and extracting dependency information.
  • [EXTERNAL_DOWNLOADS]: Instructions and audit scripts utilize npx @cloudcannon/cli to run official CloudCannon configuration and detection tools. This involves fetching and executing the vendor's CLI tool from the npm registry.
  • [COMMAND_EXECUTION]: Build and test procedures (e.g., in build.md) instruct the agent to run the project's native build commands (e.g., npm run build, hugo, npx @11ty/eleventy) and environment-specific generators to verify the migration fidelity.
  • [SAFE]: All network references and downloads target the vendor's own infrastructure (cloudcannon.com), official package registries (npm), or well-known technology documentation sites (e.g., astro.build). No suspicious domains or obfuscated execution patterns were detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 3, 2026, 03:19 PM