migrate-to-cloudcannon
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several bash scripts (e.g.,
scripts/audit-astro.sh,scripts/audit-hugo.sh) designed to automate the initial project audit phase. These scripts execute standard system commands such asfind,grep,basename,wc, andcutto gather metadata about project structure, content, and configuration. - [COMMAND_EXECUTION]: The audit scripts use
node -eto execute small JavaScript snippets for parsingpackage.jsonfiles and extracting dependency information. - [EXTERNAL_DOWNLOADS]: Instructions and audit scripts utilize
npx @cloudcannon/clito run official CloudCannon configuration and detection tools. This involves fetching and executing the vendor's CLI tool from the npm registry. - [COMMAND_EXECUTION]: Build and test procedures (e.g., in
build.md) instruct the agent to run the project's native build commands (e.g.,npm run build,hugo,npx @11ty/eleventy) and environment-specific generators to verify the migration fidelity. - [SAFE]: All network references and downloads target the vendor's own infrastructure (cloudcannon.com), official package registries (npm), or well-known technology documentation sites (e.g., astro.build). No suspicious domains or obfuscated execution patterns were detected.
Audit Metadata