sanity-ui-migration-progress
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local bash script (
scripts/measure-progress.sh) to perform static analysis on the file system. It usesripgrep,sed,tr,wc, andawkto count component instances and calculate migration percentages. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted project data (source code and package manifests), which is a standard requirement for its diagnostic purpose. While this creates an injection surface, the impact is restricted to potential report inaccuracies.
- Ingestion points: The
measure-progress.shscript reads.ts,.tsx,.jsx, andpackage.jsonfiles within the directory tree specified by the user. - Boundary markers: None; the script processes file contents directly to match import and JSX patterns.
- Capability inventory: The skill executes a shell script with file-read and text-processing capabilities via standard Unix tools.
- Sanitization: None; the script performs direct pattern matching and counting without specific content validation or escaping.
Audit Metadata