migrate-to-dovetail
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the '@heydovetail/dt' package from the npm registry, which is the official utility for the dovetail ecosystem.
- [COMMAND_EXECUTION]: The workflow involves several shell commands using the 'dt' CLI to connect to sources, validate connectivity, and perform data migrations.
- [DATA_EXFILTRATION]: While the skill moves data, it mitigates risk by enforcing a preview step and requiring manual human approval before the final migration run, ensuring no data is moved without oversight.
- [CREDENTIALS_UNSAFE]: The instructions guide the user to provide sensitive API tokens (for Notion, Airtable, etc.) via environment variables or local configuration files, which is a secure alternative to hardcoding credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (Notion, Confluence, etc.) that could theoretically contain malicious instructions. It mitigates this risk by establishing a boundary where the agent must show a preview of the content and wait for user approval before proceeding with the migration.
Audit Metadata