migration

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands for database lifecycle management, including Rails migration tasks (rails db:migrate, rails db:rollback), Ruby testing frameworks (bundle exec rspec), and cloud infrastructure diagnostics (heroku pg:diagnostics). These are standard operations for the described developer persona.
  • [EXTERNAL_DOWNLOADS]: The skill uses curl to perform health checks and verify API availability against staging.example.local and api.example.local domains during deployment phases. These requests target local/internal reserved domains for verification purposes.
  • [DATA_EXFILTRATION]: The skill reads from log/production.log and database diagnostic tools to monitor health. While this accesses potentially sensitive runtime data, it is a localized operation within the execution environment for monitoring purposes.
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for processing user-provided migration files which are then executed within the application environment.
    • Ingestion points: Database migration logic and query files reviewed in Phase 1 (Planning) and Phase 2 (Testing).
    • Boundary markers: Implements "HARD GATES" between phases (Planning, Development, Staging, Production) to ensure verification before advancing, though no specific textual delimiters are used for the code content itself.
    • Capability inventory: Full execution of Ruby/SQL logic via Rails, file system read access for logs, and network egress via curl.
    • Sanitization: The workflow mitigates risks through mandatory review steps (review-migration skill), manual performance audits (EXPLAIN ANALYZE), and idempotent cycle testing (migrate/rollback/migrate).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:23 PM
Security Audit — agent-trust-hub — migration