migrate-commet-v7-to-v8
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill involves analyzing and modifying project files (e.g., package.json, go.mod, composer.json) and executing build or test commands. This presents a potential surface for indirect prompt injection if the files being processed contain malicious content designed to influence the agent. This is a common characteristic of code-migration tools. * Ingestion points: Project configuration and source files, including package.json, go.mod, Gradle or Maven files, and composer.json (SKILL.md). * Boundary markers: None found; the skill does not explicitly instruct the agent to ignore embedded instructions in the processed files. * Capability inventory: The skill utilizes file system access to search and modify code, and shell access to run formatting, type-checking, building, and testing commands. * Sanitization: None found; the skill does not specify sanitization for the content of the project files before processing.
- [SAFE]: The external resources referenced, including SDK packages for Node.js, Python, Go, Java, and PHP, are official vendor resources belonging to the Commet ecosystem. No malicious code execution, credential exfiltration, or obfuscation was detected.
Audit Metadata