ionic-appflow-migration
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs project dependencies and CLI tools from the npm registry, including
@capawesome/cliand@capawesome/capacitor-live-update. These are legitimate vendor resources provided by the Capawesome team. - [COMMAND_EXECUTION]: The skill utilizes shell commands via the
@capawesome/clito perform migration tasks such as authentication, application creation, and build management. These commands are appropriately scoped to the migration process. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project files to identify the necessary migration steps. Ingestion points: Project configuration files including
package.json,capacitor.config.ts, and CI/CD workflow files (e.g., GitHub Actions). Boundary markers: The detection logic relies on identifying specific, documented SDK and plugin identifiers. Capability inventory: The skill requires read/write access to project files and the ability to execute vendor-specific CLI commands. Sanitization: Logic involves specific pattern matching for plugin keys and SDK names to prevent misconfiguration.
Audit Metadata