framework-migration-code-migrate

Warn

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates executable Python and JavaScript code at runtime based on the analysis of source codebases.
  • In resources/implementation-playbook.md, the Python2to3Migrator class uses the ast module and astor library to transform and generate new Python source code.
  • The create_migration_cli function generates a complete Python CLI script as a string.
  • The SQLToNoSQLMigrator class generates a database migration script for data transfer and transformation.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data (source codebases) which could contain malicious patterns.
  • Ingestion points: The MigrationAnalyzer in resources/implementation-playbook.md recursively reads all files from a user-provided source_path using Path.rglob('*').
  • Boundary markers: There are no explicit boundary markers or instructions to the model to ignore embedded malicious instructions within the source code files being analyzed.
  • Capability inventory: The skill provides functionality to generate and prompt the execution of migration scripts, CLI tools, and database operations.
  • Sanitization: There is no evidence of sanitization or validation of the content read from the source files before it is processed for migration analysis or script generation.
  • [EXTERNAL_DOWNLOADS]: The skill includes a dashboard template in resources/implementation-playbook.md that references an external script.
  • It fetches the chart.js library from jsDelivr's CDN (https://cdn.jsdelivr.net/npm/chart.js).
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 29, 2026, 01:39 AM