js-to-ts-universal-migrator
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external source code that could contain malicious instructions.
- Ingestion points: The agent ingests .js, .jsx, .vue, .mjs, and .cjs files for analysis during the identify and think phases (SKILL.md).
- Boundary markers: There are no explicit instructions or delimiters configured to prevent the agent from following prompts embedded within the source files.
- Capability inventory: The skill possesses capabilities for file system operations (writing and renaming files) and command execution (
npm install) as outlined in Phase 3 and the Security Rules (SKILL.md). - Sanitization: No sanitization or filtering logic is present for the data ingested from the project files.- [COMMAND_EXECUTION]: The skill includes a bash script (
scripts/audit-js-project.sh) designed for scanning project directories. The script utilizes standard tools likefindandgrepwith robust filename handling (null delimiters) and includes path traversal checks. Its operations are read-only except for writing a local report file.
Audit Metadata