migrating-to-zero-yaml
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes development-related commands using the Nango CLI and npm.
- Evidence: Instructions include running
nango compile,nango dev,nango dryrun,nango generate:tests, andnpm testto validate the migration. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from existing project files to generate code, which constitutes an indirect prompt injection surface.
- Ingestion points: Reads
nango.yamland existing TypeScript source files from the repository root. - Boundary markers: No explicit boundary markers are defined for the input data, but the skill provides strict mapping rules for conversion.
- Capability inventory: Writing multiple project files (
models.ts,index.ts,package.json, etc.) and executing shell commands via the CLI. - Sanitization: The skill provides a structured schema conversion logic (Zod-based) which acts as a validation layer for the transformed data.
- [DYNAMIC_EXECUTION]: The skill generates new TypeScript files and configuration at runtime, which are then compiled and executed.
- Evidence: Instructions guide the creation of
models.tsand the rewriting of sync/action files using boilerplate templates, followed by execution through thenango compileanddryruncommands.
Audit Metadata