migrate-bluejay

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes curl to perform REST API operations against api.getbluejay.ai and api.coval.dev. These commands are used for pre-flight validation, inventorying existing resources, and creating new entities in the Coval platform.
  • [INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting configuration data from an external service, which serves as a surface for indirect prompt injection.
  • Ingestion points: Step 1 in SKILL.md fetches entities including Agents, Prompts, Knowledge Bases, and Custom Metrics from the Bluejay API endpoints documented in references/bluejay-api.md.
  • Boundary markers: No explicit delimiters or boundary markers are used when interpolating fetched content into the migration payloads.
  • Capability inventory: The skill possesses network write capabilities via curl -X POST to the Coval API, as seen in Steps 3 through 9 of SKILL.md, allowing it to persist ingested data.
  • Sanitization: There is no evidence of sanitization, filtering, or validation of the data retrieved from the Bluejay platform before it is migrated to the Coval environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 05:24 PM