migrating-workflow-v4-to-v5
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [Code Analysis and Modification]: The skill directs the agent to read and rewrite application source code based on specific patterns. This represents an indirect prompt injection surface where untrusted input from the codebase could theoretically influence the agent. The skill mitigates this by providing precise regex-like rules and a mandatory verification checklist to ensure changes are limited to the intended migration scope.
- [Dependency Updates]: The instructions involve bumping versions for various Node.js packages in
package.json. The packages referenced (e.g.,workflow,@workflow/*) are provided by the official vendor and follow standard versioning practices for SDK migrations. - [Supplementary Skill Retrieval]: The skill references a command to add an additional helper skill from a public GitHub repository belonging to the same vendor. This is a common method for modularizing migration logic and is used here to extend the agent's capabilities for custom implementations.
Audit Metadata