deco-migrate-script
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands via
npx,tsx, andbunto run local migration scripts and project generators.\n- [EXTERNAL_DOWNLOADS]: The migration process usesbun installto download necessary project dependencies from the npm registry.\n- [INDIRECT_PROMPT_INJECTION]: The tool operates on untrusted external codebases provided via the--sourceparameter.\n - Ingestion points: Any files within the source directory specified during execution (e.g.,
deno.json,.tsxfiles).\n - Boundary markers: There are no explicit delimiters defined to separate untrusted source code from the migration logic.\n
- Capability inventory: Includes full file system access (read, write, delete) and subprocess execution capabilities.\n
- Sanitization: The tool utilizes static analysis and regex patterns for code transformation but does not implement comprehensive sanitization for all external inputs.\n- [DYNAMIC_EXECUTION]: The migration script dynamically generates project infrastructure files such as
vite.config.ts,package.json, and router definitions at runtime.
Audit Metadata