synapse-migration

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • Command Execution: The skill utilizes command-line interfaces, specifically dotnet and the Azure CLI (az), to execute migration utilities and manage cloud resources. These operations are required for the tool's core functionality of transforming and deploying database schema and Spark artifacts.
  • Gated Project Builds: The discovery tool includes the capability to build SQL projects using MSBuild. Recognizing that MSBuild can execute arbitrary code within project targets, the skill correctly implements a security gate that requires the user to provide an explicit flag (--allow-trusted-project-build) only after they have reviewed and trusted the source project.
  • Secure File Handling: The migration tools implement defensive programming techniques, such as validating destination paths during ZIP extraction to prevent path traversal vulnerabilities. It also employs atomic file writes and SHA-256 hashing to ensure the integrity of generated manifests and artifacts.
  • Credential Best Practices: The skill provides detailed instructions for migrating Synapse secrets and Linked Services to Microsoft Fabric. It promotes the use of Azure Key Vault for secret management and Microsoft Entra ID for authentication, discouraging the use of hardcoded credentials or SQL-based authentication.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 06:33 PM
Security Audit — agent-trust-hub — synapse-migration