render-migrate-from-heroku
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to install the Render CLI by downloading and executing a shell script directly from the vendor's repository (https://raw.githubusercontent.com/render-oss/cli/main/bin/install.sh). This installation is a necessary step for the skill to validate the generated infrastructure-as-code files.\n- [EXTERNAL_DOWNLOADS]: Fetches configuration and installation scripts from the developer's official GitHub repository and suggests the use of the Heroku MCP server.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface by automatically ingesting and processing data from local project files like Procfile and package.json to generate Render Blueprints.\n
- Ingestion points: Local configuration and dependency files read during the inventory phase in Step 1a.\n
- Boundary markers: No explicit delimiters are specified to isolate the content of ingested files from the agent's instructions.\n
- Capability inventory: The skill writes a render.yaml file to the local directory and executes Render CLI commands for validation and potential deployment.\n
- Sanitization: There are no explicit sanitization steps mentioned to filter out potentially malicious instructions embedded in project files.
Audit Metadata