migrate-validate

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill suggests the use of the @claude-flow/cli package via npx. This package is used to query validation results and appears to be a functional component of the workflow associated with the provided MCP tools.
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool and provides a CLI example for searching migration results. These operations are restricted to the purpose of managing and auditing database migrations.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it reads and parses external SQL files (.up.sql and .down.sql).
  • Ingestion points: Migration files are loaded using the Read tool.
  • Boundary markers: None are explicitly defined in the instructions to separate data from instructions.
  • Capability inventory: The agent has access to Bash and several mcp__claude-flow__* tools for data storage and retrieval.
  • Sanitization: No specific sanitization or validation of the SQL content as text is described beyond structural checks.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 01:23 PM
Security Audit — agent-trust-hub — migrate-validate