legacy-modernizer
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The LegacyCodeAnalyzer class in references/system-assessment.md utilizes subprocess.run to execute the git log command. This is used for identifying legacy system hotspots based on commit frequency.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze third-party legacy codebases using static analysis scripts. This creates a surface for indirect prompt injection if the code being analyzed contains malicious instructions.
- [EXTERNAL_DOWNLOADS]: The skill documentation and code examples suggest the use of various third-party Python packages for testing and migration, including mutmut, hypothesis, syrupy, and approvaltests. These are well-known tools in the developer ecosystem.
Audit Metadata