kata-migrate-phases
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Node.js script (
scripts/kata-lib.cjs) to manage local project settings. It performs standard filesystem operations such as reading and writing to the.planning/config.jsonfile and checking the existence of directories. No arbitrary or high-risk command execution was detected. - [DATA_EXFILTRATION]: The skill does not contain any network-enabled operations or tools. Data access is restricted to the local workspace, specifically looking for
.planningdirectories and related configuration files. - [DYNAMIC_EXECUTION]: The included JavaScript library uses standard module imports for filesystem and path utilities. It does not use
eval(),exec(), or other dynamic code evaluation methods on untrusted or external input. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local configuration files (
config.json) and project roadmaps (ROADMAP.md). However, it uses structured JSON parsing and basic regex patterns for verification without executing the content, posing no significant risk of injection.
Audit Metadata