migrate-webapi-selectall

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • Indirect Prompt Injection Surface: The skill processes project files such as JavaScript and Liquid templates, which creates a potential surface for indirect instructions in the source code to affect the agent. This is addressed by a structured workflow and evidence-based analysis rules. (1) Ingestion: Files are read during the inventory phase. (2) Boundaries: The skill requires following specific analysis rules and human confirmation at multiple gates. (3) Capability: The agent uses file editing and shell tools for the migration. (4) Sanitization: The reporting process includes HTML escaping and a Content Security Policy.
  • Local Script Execution: The skill runs bundled Node.js scripts locally to handle schema validation and report generation. (1) scripts/query-table-schema.js validates Dataverse metadata via OData queries to Microsoft-owned endpoints. (2) scripts/render-migration-report.js creates the migration report using a local template.
  • Integrated CLI Operations: The skill uses the pac CLI tool to interact with Dataverse. These operations require user-confirmed environment details and authentication context to prevent unauthorized access or accidental data modification.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 05:22 AM