latitude-migrate
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes bash commands and
curlto export project documentation and datasets from the Latitude V1 API, and it uses thelatitudeCLI to manage V2 projects and schema discovery. - [DATA_EXFILTRATION]: Accesses project environment variables, such as
LATITUDE_V1_API_KEYandLATITUDE_PROJECT_ID, to authenticate requests against vendor-owned API endpoints (gateway.latitude.soandapi.latitude.so). The skill explicitly instructs the agent never to print these secrets and to store them only in secure local secret stores or.envfiles. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it ingests existing application code and legacy prompt files to determine migration requirements.
- Ingestion points: Reads local project files (
requirements.txt,package.json,.env), V1 prompt files (.promptl), and JSON responses from the V1 API. - Boundary markers: Implements a mandatory "Plan, then wait" ground rule that requires the agent to present a detailed migration plan and receive human confirmation before executing any code changes.
- Capability inventory: Includes the ability to perform network requests, read/write local files, and install new software packages via standard package managers (npm, pip).
- Sanitization: Relies on a human-in-the-loop verification process where the user must audit the proposed migration plan before execution.
- [DYNAMIC_EXECUTION]: Programmatically generates new Python and TypeScript modules by converting legacy templates into functional code that incorporates provider-specific SDK calls and telemetry instrumentation.
Audit Metadata