evaluate-offline-migration-readiness
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- External Dependency Installation: The skill installs the
datamigrationAzure CLI extension and theCredentialManagerPowerShell module to facilitate the assessment process. The installation script for the PowerShell module includes the-SkipPublisherCheckflag. - Local Credential Retrieval: Scripts are included to retrieve saved credentials from the host's Windows Credential Manager for authenticating with SQL Server instances. This allows the tool to use existing local secrets for its operations without requiring them to be entered directly into the chat.
- Temporary Credential Storage: During assessment execution, connection strings (which may contain credentials) are written to a temporary JSON file in the user's
%TEMP%directory. The skill includes logic to remove this file upon completion or failure to minimize the risk of exposure. - External Data Ingestion Surface: The skill processes output from the
az datamigrationtool to generate readiness reports. While this introduces a potential surface for indirect instructions, the skill defines a strict output template to maintain consistency. - Ingestion points: Assessment results are read from local JSON files (e.g.,
SqlAssessment-*.json) in the user-specified output folder. - Boundary markers: The skill instructions mandate the use of a strict output template rather than free-form prose to present findings, which helps ensure output integrity.
- Capability inventory: The skill possesses the capability to run Azure CLI commands, execute PowerShell scripts for credential management, and manage local assessment files.
- Sanitization: The skill parses, counts, and classifies issues found in the tool-generated JSON data but does not explicitly detail the sanitization of individual text fields before rendering them in the report.
Audit Metadata