miro-upgrade-migration
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured guidance and code templates for upgrading Miro integrations. The instructions and scripts are consistent with the objective of migrating from REST API v1 to v2.
- [SAFE]: Network operations and dependencies are restricted to official Miro API endpoints and the public NPM registry for the official
@mirohq/miro-apiSDK, which are recognized as well-known and trusted services. - [SAFE]: Shell command execution is limited to common developer operations such as package management (
npm install), running unit tests (npm test), and auditing local source code (grep). - [SAFE]: The skill demonstrates safe credential handling by using placeholders and environment variables, explicitly advising users against hardcoding sensitive information into the source code.
- [INDIRECT_PROMPT_INJECTION]: The skill involves fetching and processing data from the Miro API, which constitutes a potential surface for indirect prompt injection if external board content is maliciously crafted. This is a standard risk for API-integrated tools and is managed by the agent's internal guardrails.
- Ingestion points: External data is ingested from Miro API responses in
SKILL.md(e.g., fetching items fromhttps://api.miro.com/v2/boards/{boardId}/items). - Boundary markers: No explicit delimiters are specified for the ingested content in the provided code snippets.
- Capability inventory: The skill possesses the ability to modify local files via
WriteandEdittools and executeBashcommands. - Sanitization: The skill performs standard JSON property access without explicit validation or escaping of text fields against malicious prompt patterns.
Audit Metadata