migrate-review
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
build-review.mjsscript utilizeschild_process.spawnto open the generated review page or local HTML file in the user's default browser using system commands likeopen,start, orxdg-opendepending on the operating system. - [DYNAMIC_EXECUTION]: The skill dynamically generates
app/review/review-html.tscontaining the report's HTML content and copiesassets/review-route.tsinto the application's source directory to enable the review functionality within a Next.js project. - [INDIRECT_PROMPT_INJECTION]: The skill processes site data which presents an indirect injection surface.
- Ingestion points: The skill reads site routes, labels, and notes from configuration files (
migrate.config.json,review.config.json) and snapshot manifests. - Boundary markers: The output is structured using HTML templates with double-brace placeholders for interpolation.
- Capability inventory: The skill can write files to the
public/andapp/directories and spawn system browser processes. - Sanitization: The skill implements an
escfunction that escapes HTML special characters (&,<,>,") for labels, routes, and notes before they are interpolated into the final report.
Audit Metadata