cxas-dfcx-migration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from Dialogflow CX agents, including playbooks, flows, and instructions. This data is processed by Gemini models in
stage_1.pyandstage_2.pyto synthesize new instructions and blueprints for CXAS. This ingestion and transformation process creates a potential surface for indirect prompt injection if the source agent contains adversarial instructions. - Ingestion points:
migrate.pyloads agent data from Google Cloud APIs or local.zipexports into aDFCXAgentIRstructure. - Boundary markers: The scripts do not explicitly define boundary markers for source data; the transformation logic is encapsulated within the
MigrationServicemethods. - Capability inventory: The skill is capable of writing state files (
_ir.json), reports, and unit tests to the local filesystem, and it performs authenticated API calls to create and update resources in Google Cloud Project. - Sanitization: The skill relies on LLM-based restructuring to transform and validate the instructions for the target environment.
- [COMMAND_EXECUTION]: The documentation provides instructions for users to execute
gcloudandpipcommands to set up the environment and authentication. The scripts themselves are interactive CLI tools that orchestrate migration tasks without executing arbitrary shell commands provided by the user. - [DYNAMIC_EXECUTION]:
stage_2.pyinvolves the modification of Python tool code to injectmock_modelogic. Additionally, the skill generates deterministic unit tests based on the migrated agent's IR. These features are intended for testing and optimization within the migration workflow.
Audit Metadata