forgerock-to-ping-journey-migration
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes platform-specific build utilities including
./gradlew,xcodebuild,npm, andpodas defined inSKILL.mdto verify project functionality. - [EXTERNAL_DOWNLOADS]: SDK libraries and configuration references are sourced from official registries like Maven Central and vendor-owned repositories on GitHub.
- [PROMPT_INJECTION]: The skill processes user-controlled codebase content, presenting a surface for indirect prompt injection. 1. Ingestion points: Reads source code and configuration files such as
AGENTS.mdandCLAUDE.mdas specified inSKILL.md. 2. Boundary markers: The skill does not use specific delimiters to isolate ingested data from instructions. 3. Capability inventory: The skill performs shell command execution for builds and extensive file-writing for source code modifications. 4. Sanitization: No specific sanitization or validation of the processed codebase content is performed.
Audit Metadata