ae-migrate-tracking-code
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted data from user project files to extract tracking implementations, creating a surface for potential injection attacks. Ingestion points: Dependency manifests (package.json, Podfile, build.gradle) and source code files. Boundary markers: Employs specific code comment markers (e.g., // @tracking) and structured JSON artifacts (scan.json, mapping.json) to manage data flow. Capability inventory: File system write operations for migration artifacts and source code updates; execution of the ae-cli tool for plan validation and upload. Sanitization: Normalizes event and property names using a snake_case convention, filters reserved provider prefixes, and requires explicit user confirmation for destructive operations or data uploads.
- [COMMAND_EXECUTION]: The skill utilizes the ae-cli platform tool to perform administrative and validation tasks, including authentication checks, tracking plan validation, and remote plan synchronization.
- [EXTERNAL_DOWNLOADS]: The skill references official SDK packages and documentation from well-known service providers like Google, Amplitude, and Mixpanel to facilitate accurate tracking migration.
Audit Metadata