runpod-migrate
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download Runpod OpenAPI specifications from official vendor domains (api.runpod.io and rest.runpod.io) for manual or script-based verification of API schemas. These files are downloaded to temporary storage and parsed as data, not executed as scripts.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted code within the user repository (Ingestion Point) using the rp_api_inventory.py script. While the skill does not explicitly use boundary markers, its capabilities are scoped to regex-based scanning and ripgrep (Capability Inventory). The script performs sanitization by reporting matches in a static markdown format rather than evaluating or executing the scanned content, effectively managing the risk associated with processing external code.
Audit Metadata