kk-migrate
Warn
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses 'npx --yes kenkeep@latest' in several sections to download and run a third-party tool from the NPM registry. This happens during dispatch, inventory collection, applying changes, and rebuilding indices.
- [REMOTE_CODE_EXECUTION]: By executing unpinned packages from a public registry via npx, the skill introduces a risk of remote code execution. A compromise of the package or the use of '@latest' could result in the execution of arbitrary code on the system.
- [COMMAND_EXECUTION]: The skill executes multiple shell commands, including node to run a local script (.ai/kenkeep/scripts/kk-detect-root.mjs), npx for the migration tool, and mktemp for temporary file creation.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by reading metadata from the knowledge base and using it to guide agent logic.
- Ingestion points: Reads JSON output from 'npx --yes kenkeep@latest place inventory' in SKILL.md.
- Boundary markers: No specific delimiters or instructions to ignore embedded content within the metadata are provided.
- Capability inventory: The agent can move files via 'place apply' and execute further CLI commands like 'index rebuild' and 'migrate okf-v3'.
- Sanitization: No sanitization or validation of the input metadata is performed before the agent processes it for clustering decisions.
Audit Metadata