rust-java-migration-testing
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell scripts (e.g., scripts/run_mutation_test.sh) and Python test suites to execute local development tools such as cargo and cargo-mutants. These operations are conducted within the local repository context for the purpose of migration verification.
- [DYNAMIC_EXECUTION]: The regression test suite (scripts/tests/test_audit_migration_tests.py) employs importlib.util to dynamically load the main auditing script during testing, facilitating automated verification of the skill's logic.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including Java and Rust source code, Markdown ledgers, and JSON manifests, which constitutes an indirect prompt injection surface.
- Ingestion points: Source code files (.java, .rs), Markdown migration ledgers, and JSON parity manifests processed by the audit scripts.
- Boundary markers: Instructions mandate that the agent treat script outputs as heuristic review candidates rather than final conclusions.
- Capability inventory: The skill is equipped to read/write project files and execute local build tools; it lacks network access.
- Sanitization: The audit scripts implement robust path traversal checks (verifying that paths do not contain '..' and remain within the project root) and use standard structured data parsers.
Audit Metadata