migrate-cloudflare-to-void
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and process various external project files, including 'package.json', 'vite.config.*', 'wrangler.jsonc', and worker entrypoints. These files serve as untrusted inputs that could contain malicious instructions designed to subvert the agent's logic during the migration process.
- Ingestion points: The agent is directed to read 'package.json', 'vite.config.', 'wrangler.jsonc', 'src/worker.', API handlers, and migration SQL files.
- Boundary markers: None identified. The instructions do not specify the use of delimiters or 'ignore' directives when processing these files.
- Capability inventory: The skill utilizes file system read/write operations, package management (npm/npx), and deployment command execution ('void deploy').
- Sanitization: No sanitization or validation logic is defined for the content extracted from the ingested files.
- [COMMAND_EXECUTION]: The migration workflow requires the execution of system commands, including package installation ('npm install'), environment initialization ('npx void init'), and deployment operations ('void account login', 'void deploy'). While these are standard for the stated purpose, they represent the execution of potentially impactful actions based on the agent's interpretation of the project state.
Audit Metadata