service-migration
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation from an external Cloudflare Pages site (react-native-nitro-geolocation.pages.dev) and installs several Node.js packages including @babel tools and migration targets through standard package managers (npm, yarn, pnpm, bun).
- [COMMAND_EXECUTION]: The bundled script
scripts/migrate-geolocation-service.mjsutilizesspawnSyncto execute shell commands for package management. It also performs significant file system modifications to the project's source code using Babel AST transformations to migrate API calls and imports. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by instructing the agent to ingest and follow instructions from remote documentation files (
llms.txtandllms-full.txt) without sanitization or boundary markers. - Ingestion points:
SKILL.md(Step 4 references external URLs for context refresh) - Boundary markers: Absent
- Capability inventory:
scripts/migrate-geolocation-service.mjs(capabilities include file-write and subprocess execution) - Sanitization: Absent
Audit Metadata