heroui-migration
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The SKILL.md file contains an installation command 'curl -fsSL https://heroui.com/install | bash' that downloads and executes a shell script directly from the vendor's official domain. This is a standard installation pattern for the vendor's tools.
- [EXTERNAL_DOWNLOADS]: Multiple scripts (e.g., scripts/get_migration_guide.mjs) fetch documentation content from heroui-git-docs-migration-heroui.vercel.app, which is a vendor-controlled deployment hosted on a well-known service provider.
- [COMMAND_EXECUTION]: The skill instructs the agent to run various Node.js scripts that retrieve migration guides from remote servers.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external MDX documentation files. While these are vendor-controlled, they represent an ingestion surface for external content. 1. Ingestion points: Scripts in the scripts/ folder fetch data from a external URL. 2. Boundary markers: No explicit delimiters or ignore instructions are present in the script outputs. 3. Capability inventory: The skill possesses network access and shell command execution capabilities. 4. Sanitization: The scripts fetch and display raw MDX content without additional validation or filtering layers.
Audit Metadata