migration
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands for database lifecycle management, including Rails migration tasks (
rails db:migrate,rails db:rollback), Ruby testing frameworks (bundle exec rspec), and cloud infrastructure diagnostics (heroku pg:diagnostics). These are standard operations for the described developer persona. - [EXTERNAL_DOWNLOADS]: The skill uses
curlto perform health checks and verify API availability againststaging.example.localandapi.example.localdomains during deployment phases. These requests target local/internal reserved domains for verification purposes. - [DATA_EXFILTRATION]: The skill reads from
log/production.logand database diagnostic tools to monitor health. While this accesses potentially sensitive runtime data, it is a localized operation within the execution environment for monitoring purposes. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for processing user-provided migration files which are then executed within the application environment.
- Ingestion points: Database migration logic and query files reviewed in Phase 1 (Planning) and Phase 2 (Testing).
- Boundary markers: Implements "HARD GATES" between phases (Planning, Development, Staging, Production) to ensure verification before advancing, though no specific textual delimiters are used for the code content itself.
- Capability inventory: Full execution of Ruby/SQL logic via Rails, file system read access for logs, and network egress via
curl. - Sanitization: The workflow mitigates risks through mandatory review steps (
review-migrationskill), manual performance audits (EXPLAIN ANALYZE), and idempotent cycle testing (migrate/rollback/migrate).
Audit Metadata