migrate-to-testomatio
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The instructions guide users to execute shell commands for cloning repositories, installing dependencies, and running migration scripts (e.g.,
git clone,npm install,node convert.js,npm start). - [REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of migration logic from official Testomat.io GitHub repositories (
github.com/testomatio/*). This is standard functionality for performing data migrations that require complex transformation logic. - [EXTERNAL_DOWNLOADS]: Fetches example migration files and documentation from vendor-controlled DigitalOcean Spaces (
testomatiofiles.ams3.cdn.digitaloceanspaces.comandtestomatio-artifacts.ams3.cdn.digitaloceanspaces.com). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external test data exported from other systems or retrieved via APIs, which represents an attack surface for untrusted content.
- Ingestion points: Data is ingested from CSV/XLSX export files and third-party TMS APIs as described in
SKILL.mdand referenced migration guides. - Boundary markers: The instructions do not specify specific delimiters for the ingested data within the agent context.
- Capability inventory: The agent is instructed to run Node.js scripts that perform file system operations and network requests.
- Sanitization: Content sanitization is expected to be handled by the specialized migration scripts rather than the agent instructions.
Audit Metadata