skills/grafana/gcx/migrate-provider/Gen Agent Trust Hub

migrate-provider

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill defines a comprehensive migration workflow including design discovery, architectural planning, and structured verification phases, prioritizing human oversight through explicit approval gates.
  • [COMMAND_EXECUTION]: The skill requires the use of standard development and testing tools, such as mise, go, and the project-specific bin/gcx binary. These operations are restricted to the local development environment and are necessary for the skill's stated purpose of software porting and validation.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface due to its ingestion of legacy source code and API definitions.
  • Ingestion points: Legacy CLI source code (pkg/grafana/{resource}/) is processed during the discovery and build phases.
  • Boundary markers: The workflow incorporates mandatory human-in-the-loop gates (ADR, Spec package, and Comparison Report) to validate agent-generated artifacts before proceeding to subsequent phases.
  • Capability inventory: The skill uses subprocess execution for build tools (mise, gcx) and standard file-system operations to create the new provider structure.
  • Sanitization: The instructions explicitly warn against inferring data shapes and mandate copying deserialization logic verbatim from the source, relying on human verification to ensure the integrity of the generated code.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 09:04 AM
Security Audit — agent-trust-hub — migrate-provider