neo4j-migration-skill
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes content from the user's codebase to identify deprecated patterns. This creates a surface where malicious instructions embedded in source code or comments could potentially influence the agent's logic.\n
- Ingestion points:
SKILL.mddefines tasks to scan various source files including.py,.js,.ts,.java,.cs,.go,.cypher, and.cql.\n - Boundary markers: The skill does not explicitly define delimiters for the ingested code content within its instructions.\n
- Capability inventory: The skill utilizes
Bashfor system scanning and testing, andWebFetchfor external documentation retrieval.\n - Sanitization: There is no evidence of sanitization or filtering applied to the codebase content before it is processed by the agent.\n- [COMMAND_EXECUTION]: The skill provides instructions to execute several shell commands via the
Bashtool for project auditing and verification. These include searching for Cypher strings usinggrep, finding dependency manifests usingfind, and running language-specific test suites (e.g.,pytest,npm test,mvn test,dotnet test,go test).\n- [EXTERNAL_DOWNLOADS]: The skill references and fetches documentation and migration guides from external sources. These include official Neo4j documentation domains (neo4j.com) and documentation stored on GitHub (raw.githubusercontent.com/wiki/neo4j/*). These downloads are used to provide the agent with relevant migration context.
Audit Metadata