monday-code-migrate
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell operations including 'npm install' for dependency management and 'npm run build' to verify the application's build process during and after migration steps.\n- [EXTERNAL_DOWNLOADS]: Downloads and installs packages from the NPM registry, specifically focusing on official vendor SDKs such as 'monday-sdk-js' and '@mondaycom/apps-sdk', alongside standard utilities like 'jsonwebtoken' and 'dotenv'.\n- [DATA_EXFILTRATION]: Scans the local project for sensitive configuration files, including '.env', in order to identify existing environment variables and secrets that need to be transitioned to the platform's native managed secret system.\n- [PROMPT_INJECTION]: The skill ingests untrusted data from the user's local project files (e.g., package.json, source directories) in SKILL.md Step 1 to plan the migration. This creates a surface for indirect prompt injection as there are no boundary markers or sanitization steps mentioned, while the agent possesses significant capabilities such as file writing and command execution.
Audit Metadata