lov-cc-mv
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the migration utility
@lovstudio/cc-mvfrom the official NPM registry.- [REMOTE_CODE_EXECUTION]: It usesnpx -yto download and execute the migration tool at runtime, which bypasses package installation confirmation.- [COMMAND_EXECUTION]: The skill performs filesystem operations and executes shell commands to move project directories and rewrite Claude Code's internal state files (JSONL).- [INDIRECT_PROMPT_INJECTION]: - Ingestion points: The skill reads session summaries using
npx -y @lovstudio/cc-mv --list-sessions --json, which extractsfirstUserPromptcontent from existing Claude Code session files in~/.claude/.- Boundary markers: There are no explicit instructions to use delimiters or ignore instructions embedded within the ingested session prompts.- Capability inventory: The skill has broad capabilities including shell command execution (npx), file movement, and modification of internal configuration files.- Sanitization: The skill does not implement sanitization for the retrieved session content before the agent evaluates it to match user migration requests.
Audit Metadata