migrate-skill-to-agent
Warn
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local bash script (
scripts/migrate.sh) to perform file system operations, including directory creation (mkdir), moving directories (mv), and creating symbolic links (ln). - [COMMAND_EXECUTION]: The migration script processes user-supplied arguments for skill names and project roots. While variables within the script are double-quoted to mitigate simple shell injection, the execution of shell commands based on external parameters represents a significant capability that requires oversight.
- [COMMAND_EXECUTION]: Ingestion points: The script takes
<skill-name>and<project-root>as positional arguments. Boundary markers: No explicit delimiters or instructions are used to sanitize or isolate these inputs within the workflow. Capability inventory: File system modification commands (mkdir,mv,ln,rm) are called withinscripts/migrate.sh. Sanitization: The script employs double-quotes for variable expansion which provides basic protection against shell word splitting.
Audit Metadata