cobol-migration-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted legacy source files (COBOL, JCL, and Copybooks), which creates a potential surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: Multiple scripts in the
scripts/directory (analyze-dependencies.sh,analyze-dependencies.ps1,extract-structure.py,generate-java-classes.py, andestimate-complexity.py) read content from local files with extensions such as.cbl,.cob,.jcl, and.cpyprovided by the user. - Boundary markers: The skill does not implement explicit boundary markers (e.g., XML tags or delimiters) or instructions to the agent to ignore embedded commands within the comments or data of the source files being analyzed.
- Capability inventory: The skill possesses file system access (read/write) and the ability to execute local shell/Python scripts to generate reports and Java source code.
- Sanitization: The provided parsing logic uses regular expressions to extract structure but does not sanitize or filter the raw text content of the legacy code before it is passed to the agent in JSON or generated class formats.
Audit Metadata