moru-skill-bundle-migration
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run local validation and audit tools, specifically
python3 scripts/workflow.py validateandvibeguard audit . --rules .. These commands are used to verify the structural integrity of documentation bundles during the migration process. - [INDIRECT_PROMPT_INJECTION]: The skill operates on markdown documentation files (
SKILL.mdandreferences/*.md), which serves as an ingestion point for potentially untrusted data. - Ingestion points: Content from
SKILL.mdand files within thereferences/directory. - Boundary markers: The skill uses YAML frontmatter and Markdown headings to delineate sections.
- Capability inventory: The skill has capabilities to move files, delete files, update routing logic, and execute local scripts (
scripts/workflow.py,vibeguard). - Sanitization: No specific sanitization or filtering of the documentation content is performed before processing.
Audit Metadata