lovstudio-cc-mv
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses npx to download and run the @lovstudio/cc-mv package. This is a vendor-owned resource that contains the logic for the migration.\n- [COMMAND_EXECUTION]: Executes shell commands including npx, mv, and ln to perform the migration and manage symlinks. These operations are restricted to the project folder and the Claude Code configuration directory.\n- [DATA_EXFILTRATION]: Reads session data and history from the ~/.claude/ directory to update file paths. The analysis confirms these operations are local and intended to maintain history continuity.\n- [PROMPT_INJECTION]: Indirect prompt injection surface identified in session filtering logic.\n
- Ingestion points: The skill reads session data including firstUserPrompt via npx @lovstudio/cc-mv --list-sessions.\n
- Boundary markers: No explicit delimiters or instructions are used to separate the ingested prompts from the agent's task instructions.\n
- Capability inventory: The agent can execute shell commands (npx) and perform file system operations.\n
- Sanitization: No specific sanitization of prompt content is performed beyond resolving absolute directory paths.
Audit Metadata