blume-migrate

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions direct the agent to execute several bundled Node.js scripts (e.g., mintlify-codemod.mjs, docsify-codemod.mjs, jekyll-codemod.mjs) to automate code and content modifications.
  • [EXTERNAL_DOWNLOADS]: The migration workflow involves fetching emoji mappings from GitHub's public API (api.github.com) using curl to support shortcode conversion.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data, as it is designed to process and convert documentation files from numerous external frameworks.
  • Ingestion points: Processes existing project files (Markdown, MDX, and YAML/JSON configurations) from various source frameworks (specified in SKILL.md).
  • Boundary markers: Conversion scripts use regular expressions and specific delimiters (like --- for frontmatter) to identify and transform content.
  • Capability inventory: The skill utilizes file system read/write operations and network requests (via fetch in pin-heading-ids.mjs) to analyze and modify documentation.
  • Sanitization: Bundled codemod scripts include logic to sanitize and escape characters for compatibility with MDX (e.g., escaping braces and self-closing void tags in vitepress-codemod.mjs).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 07:01 PM