cxas-dfcx-migration

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from Dialogflow CX agents, including playbooks, flows, and instructions. This data is processed by Gemini models in stage_1.py and stage_2.py to synthesize new instructions and blueprints for CXAS. This ingestion and transformation process creates a potential surface for indirect prompt injection if the source agent contains adversarial instructions.
  • Ingestion points: migrate.py loads agent data from Google Cloud APIs or local .zip exports into a DFCXAgentIR structure.
  • Boundary markers: The scripts do not explicitly define boundary markers for source data; the transformation logic is encapsulated within the MigrationService methods.
  • Capability inventory: The skill is capable of writing state files (_ir.json), reports, and unit tests to the local filesystem, and it performs authenticated API calls to create and update resources in Google Cloud Project.
  • Sanitization: The skill relies on LLM-based restructuring to transform and validate the instructions for the target environment.
  • [COMMAND_EXECUTION]: The documentation provides instructions for users to execute gcloud and pip commands to set up the environment and authentication. The scripts themselves are interactive CLI tools that orchestrate migration tasks without executing arbitrary shell commands provided by the user.
  • [DYNAMIC_EXECUTION]: stage_2.py involves the modification of Python tool code to inject mock_mode logic. Additionally, the skill generates deterministic unit tests based on the migrated agent's IR. These features are intended for testing and optimization within the migration workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 02:19 PM
Security Audit — agent-trust-hub — cxas-dfcx-migration