project-migration
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard development toolchain commands, including
gitfor version control,uvfor Python packages,pnpmfor Node.js modules,apmfor agent skills, andmisefor runtime management. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes existing project configuration files, such as
package.jsonandpyproject.toml, to generate migration plans. This potential attack surface is mitigated by instructions requiring the agent to present diffs and obtain explicit user confirmation before modifying or deleting any files. - [EXTERNAL_DOWNLOADS]: The workflow involves fetching project blueprints and skill dependencies from the vendor's own repositories (
loxosceles/project-blueprintsandloxosceles/ai-dev). These operations are consistent with the skill's primary purpose and use vendor-owned resources.
Audit Metadata