azure-cloud-migrate
Warn
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill's metadata claims 'Microsoft' as the author, which conflicts with the provided author context 'kinnekate-hub', potentially leading users or the agent to misattribute the skill's origin or authority.
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to ingest and analyze untrusted source code and configuration files from AWS/GCP environments during the migration assessment. * Ingestion points: Reads AWS Lambda source code, SAM templates, and CloudFormation templates from the workspace (assessment.md). * Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore embedded instructions within the processed source code. * Capability inventory: The skill has the capability to write files to the workspace and execute shell commands via the agent (SKILL.md, code-migration.md). * Sanitization: There is no evidence of sanitization, filtering, or validation of the content extracted from external source files before it is processed by the agent.
- [COMMAND_EXECUTION]: Instructs the agent to execute system commands including Azure Developer CLI ('azd') for project initialization and Azure Functions Core Tools for local development.
- [EXTERNAL_DOWNLOADS]: References and downloads infrastructure templates from official Azure sample repositories on GitHub.
Audit Metadata