migration-framework
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest and process external integration data (migration-schema.json), which contains scripts and metadata from third-party platforms. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the source data to influence the generated TypeScript code.
- Ingestion points: Data enters via the migration-schema.json file, specifically through the script_content fields in the scripts and data_transformations sections.
- Boundary markers: The instructions do not define specific delimiters or warnings for the agent to ignore instructions embedded within the source content during processing.
- Capability inventory: The skill enables the agent to generate complex integration logic and TypeScript code based on the provided schema.
- Sanitization: There is no mention of automated sanitization or validation of the Groovy source code or external metadata before it is processed for translation.
Audit Metadata