lov-cc-mv
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y @lovstudio/cc-mvandnpx -y @lovstudio/cc-migrate-sessionto download and run code from the NPM registry. These resources are owned by the skill author. - [COMMAND_EXECUTION]: The skill executes shell commands to perform directory moves, read session lists, and update internal configuration files in the
~/.claudedirectory. - [PROMPT_INJECTION]: The skill evaluates untrusted data from Claude Code's session history (e.g.,
firstUserPrompt) to summarize or filter sessions for the user. While this creates a surface where malicious session content could influence the agent, the risk is inherent to the task of managing chat history. - Ingestion points: Reads session metadata from the JSON output of the CLI tool in
SKILL.md. - Boundary markers: None identified in the instructions for displaying or processing session data.
- Capability inventory: Includes filesystem directory moves and modifications to the user's Claude Code state files.
- Sanitization: The skill does not specify sanitization or escaping for the session content before it is processed by the agent.
Audit Metadata