identity-migration-analyzer
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external structured business signals (JSON/CSV), creating a vulnerability surface where malicious instructions could be embedded in the input data to influence the agent's behavior.
- Ingestion points: The run.py script reads data from a file path provided via the --input command-line argument.
- Boundary markers: The skill does not define specific delimiters or security instructions to help the agent distinguish between data and potentially malicious embedded prompts.
- Capability inventory: the run.py script utilizes the pathlib and json modules to read from and write to the local filesystem.
- Sanitization: There is no evidence of data sanitization, schema validation, or content filtering performed on the input payload before it is processed by the script.
Audit Metadata