framework-migration-code-migrate
Warn
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates executable Python and JavaScript code at runtime based on the analysis of source codebases.
- In
resources/implementation-playbook.md, thePython2to3Migratorclass uses theastmodule andastorlibrary to transform and generate new Python source code. - The
create_migration_clifunction generates a complete Python CLI script as a string. - The
SQLToNoSQLMigratorclass generates a database migration script for data transfer and transformation. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data (source codebases) which could contain malicious patterns.
- Ingestion points: The
MigrationAnalyzerinresources/implementation-playbook.mdrecursively reads all files from a user-providedsource_pathusingPath.rglob('*'). - Boundary markers: There are no explicit boundary markers or instructions to the model to ignore embedded malicious instructions within the source code files being analyzed.
- Capability inventory: The skill provides functionality to generate and prompt the execution of migration scripts, CLI tools, and database operations.
- Sanitization: There is no evidence of sanitization or validation of the content read from the source files before it is processed for migration analysis or script generation.
- [EXTERNAL_DOWNLOADS]: The skill includes a dashboard template in
resources/implementation-playbook.mdthat references an external script. - It fetches the
chart.jslibrary from jsDelivr's CDN (https://cdn.jsdelivr.net/npm/chart.js).
Audit Metadata