migrate
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard system commands including
mkdir,cp,mv,ln, andrmdirto manage the project's context store and symlinks. These operations are restricted to the repository root and a project-specific directory within~/.codevoyant/. - [DYNAMIC_EXECUTION]: The skill utilizes local Python scripts and inline Python execution via heredocs for processing JSON metadata and normalizing Markdown registries. These scripts use standard library modules (
json,sys,os,re) and do not process untrusted code from external sources. - [DATA_EXPOSURE]: The skill manages project context data stored in
~/.codevoyant/. This directory is used cross-worktree to maintain project state and does not involve accessing sensitive system credentials or personal user data. - [INDIRECT_PROMPT_INJECTION]: The migration logic ingests data from local store files (
metadata.json,README.md) and plan directories. - Ingestion points: Reads version tags from migration files and status records from the store registry.
- Boundary markers: Commands are gated by a manual confirmation step requiring the user to approve the specific list of migration files before execution.
- Capability inventory: Limited to file management and structured data manipulation within the scoped project store.
- Sanitization: Uses standard JSON and string parsing to handle store content.
Audit Metadata