legacy-modernizer
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides an assessment script in
references/system-assessment.mdthat executesgit logviasubprocess.run. This is used for 'hotspot' analysis to find frequently changed files in the legacy system. This is a legitimate development use case.- [EXTERNAL_DOWNLOADS]: The reference documentation suggests the use of several standard Python testing and quality tools, includingpytest,mutmut,hypothesis,coverage.py,syrupy, andapprovaltests. These are common, well-known libraries in the software engineering community.- [INDIRECT_PROMPT_INJECTION]: The skill includes code to analyze user-provided legacy codebases. * Ingestion points: TheLegacyCodeAnalyzerclass inreferences/system-assessment.mdreads all files within a provided path. * Boundary markers: The static analysis logic does not use specific boundary markers or 'ignore' instructions. * Capability inventory: The skill demonstrates capabilities for executing shell commands (git), reading/writing local files, and proxying network requests tolocalhost. * Sanitization: The analyzer usesast.parsefor structural analysis, which is a safe, non-executable method of processing code content.
Audit Metadata