sanity-ui-migration-progress

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local bash script (scripts/measure-progress.sh) to perform static analysis on the file system. It uses ripgrep, sed, tr, wc, and awk to count component instances and calculate migration percentages.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted project data (source code and package manifests), which is a standard requirement for its diagnostic purpose. While this creates an injection surface, the impact is restricted to potential report inaccuracies.
  • Ingestion points: The measure-progress.sh script reads .ts, .tsx, .jsx, and package.json files within the directory tree specified by the user.
  • Boundary markers: None; the script processes file contents directly to match import and JSX patterns.
  • Capability inventory: The skill executes a shell script with file-read and text-processing capabilities via standard Unix tools.
  • Sanitization: None; the script performs direct pattern matching and counting without specific content validation or escaping.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 06:48 AM
Security Audit — agent-trust-hub — sanity-ui-migration-progress