netbox-migration
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting data from potentially untrusted external sources, such as spreadsheets, legacy system exports, and discovery data.
- Ingestion points: The migration methodology relies on reading data from
sites.csv,devices.csv, and other external files as described inreferences/import-patterns.mdandreferences/source-mapping.md. - Boundary markers: The skill lacks explicit instructions for the agent to treat imported data as untrusted or to utilize delimiters/boundary markers when processing spreadsheet content to prevent the execution of embedded instructions.
- Capability inventory: The skill exhibits significant write capabilities, utilizing
pynetboxand theDiode SDKto perform bulk object creation and modification within the NetBox database (references/import-patterns.md). - Sanitization: The provided Python code patterns perform direct mapping of source fields to API payloads without implementing sanitization or validation checks for malicious content within the data values.
Audit Metadata