mistral-upgrade-migration

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic execution syntax to check for installed SDK versions using npm list and pip show at load time. These commands are diagnostic and do not involve sensitive file access or network exfiltration.
  • [INDIRECT_PROMPT_INJECTION]: The skill includes a migration script that ingests source code from the user's project.
  • Ingestion points: The script scripts/migrate-mistral-v1.ts reads files located in src/**/*.{ts,js}.
  • Boundary markers: The script lacks explicit markers or instructions to differentiate between data and instructions within the processed source files.
  • Capability inventory: The skill has access to file writing and shell command execution (npm, git, node).
  • Sanitization: The script performs direct regex-based transformations on input code without validation or sanitization.
  • [COMMAND_EXECUTION]: The skill provides instructions for executing shell commands to manage branches, install packages, and run tests. These are standard operations for code migration tasks.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the official Mistral AI SDK and development dependencies like vitest and glob from official package registries. These sources are recognized as well-known service providers.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 11:16 AM