migration-framework

Pass

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is designed to ingest and process external integration data (migration-schema.json), which contains scripts and metadata from third-party platforms. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the source data to influence the generated TypeScript code.
  • Ingestion points: Data enters via the migration-schema.json file, specifically through the script_content fields in the scripts and data_transformations sections.
  • Boundary markers: The instructions do not define specific delimiters or warnings for the agent to ignore instructions embedded within the source content during processing.
  • Capability inventory: The skill enables the agent to generate complex integration logic and TypeScript code based on the provided schema.
  • Sanitization: There is no mention of automated sanitization or validation of the Groovy source code or external metadata before it is processed for translation.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 16, 2026, 02:31 PM