subgraph-migrate
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the vendor's official CLI tool,
goldsky, to perform subgraph deployment, management, and tagging. These commands are consistent with the skill's stated purpose of facilitating subgraph migration. - [INDIRECT_PROMPT_INJECTION]: The skill manages the attack surface for indirect injection by defining clear ingestion points for untrusted data. Specifically, user-provided GraphQL endpoints and IPFS hashes are used as arguments for the
goldsky subgraph deploycommand. The skill instructs the agent to ask the user directly for these values, establishing a trust boundary. Capability analysis shows the skill leverages existing CLI tools for deployment, and the instructions use standard placeholders to ensure parameters are correctly scoped. - [EXTERNAL_DOWNLOADS]: The skill provides links to the vendor's official documentation and support email, which are official resources provided by the service author and do not represent a security risk.
Audit Metadata