migrate-review

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The build-review.mjs script utilizes child_process.spawn to open the generated review page or local HTML file in the user's default browser using system commands like open, start, or xdg-open depending on the operating system.
  • [DYNAMIC_EXECUTION]: The skill dynamically generates app/review/review-html.ts containing the report's HTML content and copies assets/review-route.ts into the application's source directory to enable the review functionality within a Next.js project.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes site data which presents an indirect injection surface.
  • Ingestion points: The skill reads site routes, labels, and notes from configuration files (migrate.config.json, review.config.json) and snapshot manifests.
  • Boundary markers: The output is structured using HTML templates with double-brace placeholders for interpolation.
  • Capability inventory: The skill can write files to the public/ and app/ directories and spawn system browser processes.
  • Sanitization: The skill implements an esc function that escapes HTML special characters (&, <, >, ") for labels, routes, and notes before they are interpolated into the final report.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 09:58 PM