migrate-to-ouds-web
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
@ouds/web-migratetool usingnpxto perform automated code migrations. This is a standard operation for the skill's intended purpose. - [EXTERNAL_DOWNLOADS]: The agent is instructed to download and run the
@ouds/web-migratepackage from the public npm registry. This package is a vendor-owned resource associated with the skill author. - [INDIRECT_PROMPT_INJECTION]: The skill processes project source code (HTML, CSS, JS, etc.) which constitutes an attack surface for instructions embedded in data. 1. Ingestion points: Project files identified in the file glob selection (Step 2), such as .html, .css, .vue, and .tsx files. 2. Boundary markers: Absent. The skill does not define specific delimiters for the processed content. 3. Capability inventory: The skill executes shell commands via npx and modifies local project files. 4. Sanitization: The instructions explicitly require the user to review all changes using git diff and provide a comprehensive post-migration checklist to ensure the integrity of the migration.
Audit Metadata