migrate-webapi-selectall
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Indirect Prompt Injection Surface: The skill processes project files such as JavaScript and Liquid templates, which creates a potential surface for indirect instructions in the source code to affect the agent. This is addressed by a structured workflow and evidence-based analysis rules. (1) Ingestion: Files are read during the inventory phase. (2) Boundaries: The skill requires following specific analysis rules and human confirmation at multiple gates. (3) Capability: The agent uses file editing and shell tools for the migration. (4) Sanitization: The reporting process includes HTML escaping and a Content Security Policy.
- Local Script Execution: The skill runs bundled Node.js scripts locally to handle schema validation and report generation. (1)
scripts/query-table-schema.jsvalidates Dataverse metadata via OData queries to Microsoft-owned endpoints. (2)scripts/render-migration-report.jscreates the migration report using a local template. - Integrated CLI Operations: The skill uses the
pacCLI tool to interact with Dataverse. These operations require user-confirmed environment details and authentication context to prevent unauthorized access or accidental data modification.
Audit Metadata