migrate-bootstrap

Pass

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • Local Script Execution: The skill initiates an environment check by executing a local Node.js script (check-version.js) located within the plugin directory. This is used to verify version compatibility before starting the migration process.
  • Command Line Interface Integration: It utilizes the Power Platform CLI (pac) for core operations, including downloading site configurations, running the migration engine, and uploading the migrated content. These commands are fundamental to the skill's purpose and are performed using the vendor's official command-line tools.
  • Network Operations: The skill performs network checks using curl to verify that the target Power Pages portal is active and provisioned. This connectivity is restricted to the environment URL provided by the user or discovered through the CLI.
  • Version Control Integration: It uses git to create local snapshots of the site content before and during the migration. This provides a restore point and is a best practice for managing changes to source code.
  • Indirect Prompt Injection Surface: The skill processes and modifies external files, such as HTML, CSS, and Liquid templates, during the AI-assisted fix phase. While this creates a potential surface for indirect prompt injection if the source files contain malicious instructions, the risk is inherent to the task of code migration and is mitigated by the requirement for user consent before applying changes.
  • Ingestion points: Site content files (*.html, *.css, *.js, *.webtemplate.source.html) and configuration files (website.yml, sitesetting.yml) in the site folder.
  • Boundary markers: Not explicitly defined in the file-processing prompts.
  • Capability inventory: Bash (for CLI and network tools), Edit, and Write capabilities across all project files.
  • Sanitization: No explicit sanitization of the site content is performed prior to processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 15, 2026, 04:44 PM
Security Audit — agent-trust-hub — migrate-bootstrap