migrate-codeceptjs-4
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to run multiple shell commands to perform the migration process. Evidence includes instructions to execute
npm install,npx codeceptjs check,npx codeceptjs run, andnpx codeceptjs run-workers. These commands are essential for updating dependencies and verifying the success of the migration within the local development environment.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of external libraries via official package managers. The agent is instructed to install packages such ascodeceptjs@4,tsx,ai, and various AI SDK providers. All identified packages are well-known, reputable resources from the NPM registry, and their use is consistent with the skill's stated purpose.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon the contents of a user's project files, creating an attack surface for indirect prompt injection. \n - Ingestion points: The agent is instructed to read and analyze
package.json, test scripts, page objects, and configuration files to identify necessary changes.\n - Boundary markers: No explicit instructions or delimiters are provided to the agent to treat external file content as untrusted or to ignore embedded instructions.\n
- Capability inventory: The agent has the authority to write to the file system, install new packages, and execute code through the test runner.\n
- Sanitization: The skill lacks mechanisms to sanitize or validate the content of the analyzed source files before processing them.
Audit Metadata