runpod-migrate
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download OpenAPI specification files from
api.runpod.ioandrest.runpod.ioto/tmp/. These downloads target official vendor infrastructure and are used as data sources for schema validation during the migration process. - [COMMAND_EXECUTION]: The skill utilizes a Python script (
rp_api_inventory.py) to scan the user's repository for legacy API patterns. This script uses the Python standard library and performs a local inventory of the codebase, which is a required step for the stated migration workflow. - [DYNAMIC_EXECUTION]: The skill contains Python code blocks (heredocs) executed via shell to parse the downloaded OpenAPI JSON files. This is used to programmatically verify field requirements and is not influenced by untrusted external code.
- [INDIRECT_PROMPT_INJECTION]: The inventory script reads file contents from the user's codebase to identify API call sites. While this represents a data ingestion surface, the script includes logic to escape data for the Markdown report and focuses strictly on identifying specific API-related regex patterns.
Audit Metadata