migrate-to-saaskit
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires the agent to read sensitive API credentials, specifically SCALEKIT_CLIENT_SECRET, from the environment to authorize migration operations in SKILL.md.\n- [EXTERNAL_DOWNLOADS]: The skill recommends installing the @scalekit-sdk/node library in SKILL.md (Step 3), which is a trusted vendor-provided SDK required for the migration process.\n- [DATA_EXFILTRATION]: The agent is instructed in SKILL.md and references/AUDIT-CHECKLIST.md to export and transfer sensitive entity data, including user emails and organization metadata, from the source authentication provider to the vendor platform.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from existing authentication systems, which represents a surface for indirect prompt injection.\n
- Ingestion points: User profile data and organization settings retrieved from the source system as specified in SKILL.md (Step 2) and references/AUDIT-CHECKLIST.md.\n
- Boundary markers: The instructions do not define specific delimiters or warnings to ignore embedded instructions within the imported data.\n
- Capability inventory: The skill possesses network communication capabilities via the Scalekit SDK and curl in SKILL.md (Steps 3 and 4) to transmit data to the vendor API.\n
- Sanitization: No specific sanitization or validation logic is outlined for the external data being processed.
Audit Metadata