qe-aqe-v2-v3-migration
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from legacy project installations to perform migration tasks.
- Ingestion points: Accesses and reads from existing project directories including
.agentic-qe/config.json(configuration),.agentic-qe/memory.db(SQLite database), and.agentic-qe/patterns/(SKILL.md). - Capability inventory: The skill can execute package manager commands (
npm install), project CLI tools (aqe migrate), and spawn sub-agents for coding and research tasks (SKILL.md). - Boundary markers: No explicit delimiters or boundary markers are instructed for the data being processed from v2 files.
- Sanitization: There is no documentation of input validation or sanitization for the legacy memory and configuration data before it is indexed or converted into the v3 format.
Audit Metadata