migrate-sonar-to-agent-api
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted user codebases to identify API usage patterns. This creates an attack surface where malicious instructions embedded in the analyzed code (e.g., in comments or string literals) could attempt to influence the agent's behavior during the migration process.
- Ingestion points: The agent reads files from a user-specified directory path during the migration scan as instructed in SKILL.md.
- Boundary markers: The instructions do not specify explicit delimiters or warnings to ignore instructions within the analyzed code.
- Capability inventory: The skill utilizes subprocess execution for scanning (scripts/scan_sonar_usage.py) and verification tasks such as compilation and type-checking (references/verification.md).
- Sanitization: No specific sanitization or filtering of the ingested code content is performed before processing.
- [COMMAND_EXECUTION]: The skill's workflow involves executing a local Python script (scripts/scan_sonar_usage.py) to scan the codebase. It also recommends running compilation and type-checking commands (python -m py_compile, tsc --noEmit) to verify migration results. These are standard developer operations intended for the skill's primary purpose.
- [EXTERNAL_DOWNLOADS]: The documentation references official vendor packages (perplexityai on PyPI, @perplexity-ai/perplexity_ai on NPM) and provides instructions for their installation. All referenced URLs belong to the official vendor infrastructure and are used neutrally for configuration and documentation purposes.
Audit Metadata