mistral-upgrade-migration
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic execution syntax to check for installed SDK versions using
npm listandpip showat load time. These commands are diagnostic and do not involve sensitive file access or network exfiltration. - [INDIRECT_PROMPT_INJECTION]: The skill includes a migration script that ingests source code from the user's project.
- Ingestion points: The script
scripts/migrate-mistral-v1.tsreads files located insrc/**/*.{ts,js}. - Boundary markers: The script lacks explicit markers or instructions to differentiate between data and instructions within the processed source files.
- Capability inventory: The skill has access to file writing and shell command execution (
npm,git,node). - Sanitization: The script performs direct regex-based transformations on input code without validation or sanitization.
- [COMMAND_EXECUTION]: The skill provides instructions for executing shell commands to manage branches, install packages, and run tests. These are standard operations for code migration tasks.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the official Mistral AI SDK and development dependencies like
vitestandglobfrom official package registries. These sources are recognized as well-known service providers.
Audit Metadata