documenso-migration-deep-dive
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file utilizes the
!command`` syntax to executenpm list 2>/dev/null | head -10when the skill is loaded. This is a diagnostic command used to verify the local environment and is considered safe practice for development-oriented skills. - [INDIRECT_PROMPT_INJECTION]: The skill's migration logic involves ingesting untrusted data from existing codebases and external signing platform configurations, creating a potential injection surface.
- Ingestion points: The assessment scripts in
SKILL.mdandreferences/implementation-guide.md(e.g.,assessCurrentSystemandanalyzeCodebase) read data from the filesystem and external APIs. - Boundary markers: The provided implementation examples do not include explicit delimiters or instructions to ignore embedded commands in the processed data.
- Capability inventory: The skill is granted
Bash,Write, andEditcapabilities, which could be misused if malicious instructions are successfully injected through the data ingestion points. - Sanitization: The provided code templates lack validation or escaping logic for external content before processing.
Audit Metadata