migrating-to-saaskit

Pass

Audited by Gen Agent Trust Hub on Jul 25, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is designed for authentication migration, which naturally involves handling sensitive data such as user emails, organization IDs, and SSO configurations. This data handling is restricted to the skill's primary purpose and follows standard migration patterns.
  • [COMMAND_EXECUTION]: Provides bash snippets in SKILL.md (Phase 5) for verifying migration success. These commands use environment variables ($SCALEKIT_CLIENT_ID, $SCALEKIT_CLIENT_SECRET) for authentication rather than hardcoded credentials, which is a recommended security practice.
  • [EXTERNAL_DOWNLOADS]: References official Scalekit API endpoints and SDKs. All URLs in the documentation and code samples use placeholders (e.g., <SCALEKIT_ENVIRONMENT_URL>) or target the vendor's own infrastructure, presenting no unauthorized exfiltration or supply chain risk.
  • [DATA_EXFILTRATION]: While the skill involves exporting and importing user data, it explicitly instructs the user to store identifiers in external_id and maintain local backups. There are no patterns suggesting data is sent to unauthorized third-party domains.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 25, 2026, 08:02 PM
Security Audit — agent-trust-hub — migrating-to-saaskit