migrate-to-parallel
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bundled Python script (
scripts/scan_provider_usage.py) to perform an inventory of legacy search provider usage within a repository. This script is designed for local execution and relies exclusively on standard library modules to perform static analysis of project files. - [CREDENTIALS_UNSAFE]: The migration process and its associated scanning script are designed to identify API keys and configuration settings, specifically targeting sensitive files such as
.envand package manifests. The instructions include explicit safeguards, directing the agent to verify the presence of credentials without printing their actual values or exposing them in logs. - [PROMPT_INJECTION]: The skill processes untrusted data from the user's repository, which represents an indirect prompt injection attack surface.
- Ingestion points: The bundled scanner script reads the content of all text-based files in the target repository to identify migration targets.
- Boundary markers:
SKILL.mdcontains instructions to treat scan results as an aid rather than proof of completeness and provides warnings against the exposure of secret values. - Capability inventory: The agent is tasked with file ingestion, executing a bundled inventory script, and performing code modifications to replace legacy provider calls.
- Sanitization: No automated sanitization is applied to the scanned repository content; the skill relies on instructional guardrails for the agent to handle the data safely.
Audit Metadata