mvpfy-migrate
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes content from existing
MVP.mdor legacy documents, which creates a potential surface for indirect prompt injection. Maliciously crafted content within these documents could attempt to influence agent behavior during the migration. - Ingestion points: Document content is read from the project directory via
scripts/migrate-company.mjs. - Boundary markers: No specific delimiters or warnings to ignore embedded instructions are present in the migration instructions.
- Capability inventory: The skill has permissions to read and write files within the specified project directory.
- Sanitization: The script merges and normalizes document content without explicit sanitization or filtering of potential instructions.
- [COMMAND_EXECUTION]: The skill executes a local utility script
scripts/migrate-company.mjsto perform the document migration. This script performs file system operations and depends on local modules located in sibling directories within the vendor's ecosystem.
Audit Metadata