tui-migration

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard package management and build system commands such as npm install, ng update, and nx migrate. These are routine operations for Angular and Nx development environments.
  • [EXTERNAL_DOWNLOADS]: The skill triggers downloads of official Taiga UI packages and peer dependencies (e.g., @taiga-ui/cdk, maskito, ts-morph) from the standard NPM registry.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and act upon // TODO: (Taiga UI migration) comments found in the project's source code.
  • Ingestion points: Project source files including TypeScript (.ts), HTML (.html), and Style (.css, .scss) files, as well as configuration files like package.json.
  • Boundary markers: Absent. The instructions do not specify delimiters for external code content when processed by the agent.
  • Capability inventory: The agent can execute shell commands (npm, ng, nx) and write or modify files within the project directory.
  • Sanitization: The skill includes procedural mitigations, instructing the agent to only apply fixes when safe based on surrounding context and to consult the user if a fix is ambiguous.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 07:44 PM