miro-upgrade-migration

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill provides structured guidance and code templates for upgrading Miro integrations. The instructions and scripts are consistent with the objective of migrating from REST API v1 to v2.
  • [SAFE]: Network operations and dependencies are restricted to official Miro API endpoints and the public NPM registry for the official @mirohq/miro-api SDK, which are recognized as well-known and trusted services.
  • [SAFE]: Shell command execution is limited to common developer operations such as package management (npm install), running unit tests (npm test), and auditing local source code (grep).
  • [SAFE]: The skill demonstrates safe credential handling by using placeholders and environment variables, explicitly advising users against hardcoding sensitive information into the source code.
  • [INDIRECT_PROMPT_INJECTION]: The skill involves fetching and processing data from the Miro API, which constitutes a potential surface for indirect prompt injection if external board content is maliciously crafted. This is a standard risk for API-integrated tools and is managed by the agent's internal guardrails.
  • Ingestion points: External data is ingested from Miro API responses in SKILL.md (e.g., fetching items from https://api.miro.com/v2/boards/{boardId}/items).
  • Boundary markers: No explicit delimiters are specified for the ingested content in the provided code snippets.
  • Capability inventory: The skill possesses the ability to modify local files via Write and Edit tools and execute Bash commands.
  • Sanitization: The skill performs standard JSON property access without explicit validation or escaping of text fields against malicious prompt patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 11:34 PM
Security Audit — agent-trust-hub — miro-upgrade-migration