migrate-internal-package
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Git commands for history manipulation and package manager commands for environment setup. These operations include hygiene practices like isolated worktrees and ancestry verification.\n- [COMMAND_EXECUTION]: A bash script,
scripts/merge-history-pr, interacts with the GitHub API to manage repository settings and merges. The workflow is designed to ensure administrative actions are performed by a human after a dry-run validation.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Git repositories. This attack surface is mitigated by the trusted source context and the use of programmatic verification steps and human review checkpoints within the migration workflow.
Audit Metadata