orpc-migrate
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill provides a legitimate playbook for software migration and library upgrades, focusing on refactoring import paths and builder methods.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch documentation from the official orpc.dev domain, including files like llms-full.txt. This creates a surface for indirect prompt injection if the source were compromised, but the behavior is appropriate for the skill's primary purpose of providing up-to-date migration guidance.
- [EXTERNAL_DOWNLOADS]: The instructions direct the installation of official @orpc packages from the npm registry, which is a functional requirement for the migration process.
- [COMMAND_EXECUTION]: The playbook includes standard npm commands for package installation and metadata inspection, such as checking distribution tags. These are routine development operations.
Audit Metadata