migrating-to-zero-yaml

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes development-related commands using the Nango CLI and npm.
  • Evidence: Instructions include running nango compile, nango dev, nango dryrun, nango generate:tests, and npm test to validate the migration.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from existing project files to generate code, which constitutes an indirect prompt injection surface.
  • Ingestion points: Reads nango.yaml and existing TypeScript source files from the repository root.
  • Boundary markers: No explicit boundary markers are defined for the input data, but the skill provides strict mapping rules for conversion.
  • Capability inventory: Writing multiple project files (models.ts, index.ts, package.json, etc.) and executing shell commands via the CLI.
  • Sanitization: The skill provides a structured schema conversion logic (Zod-based) which acts as a validation layer for the transformed data.
  • [DYNAMIC_EXECUTION]: The skill generates new TypeScript files and configuration at runtime, which are then compiled and executed.
  • Evidence: Instructions guide the creation of models.ts and the rewriting of sync/action files using boilerplate templates, followed by execution through the nango compile and dryrun commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 05:53 PM
Security Audit — agent-trust-hub — migrating-to-zero-yaml