claude-code-migration-kit
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads migration templates and utility scripts from the official Anthropics GitHub repository (github.com/anthropics/code-migration-kit-with-claude-code).
- [COMMAND_EXECUTION]: The workflow involves executing local automation scripts (e.g.,
queue_runner.mjs,build_daemon.sh) and standard language-specific build tools (e.g.,cargo build) to perform the migration and verification steps. - [PROMPT_INJECTION]: The skill is designed to ingest and process external source code files during the migration process, creating an indirect prompt injection surface. The risk is minimized by the skill's structured approach, including rulebooks and adversarial review steps.
- Ingestion points: Files within the source repository path (e.g.,
./src). - Boundary markers: The skill uses structured prompt templates and a mandatory rulebook to define the scope and constraints of the LLM's output.
- Capability inventory: The agent is authorized to write to the
migration/translated/directory and execute build commands via a dedicated build daemon. - Sanitization: The skill does not explicitly perform sanitization of the input source code before interpolation into migration prompts.
Audit Metadata