migrate-project
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it ingests and analyzes the contents of a user-provided target repository.
- Ingestion points: Specialized subagents (Analyzer, Mapper, Migrator, and Verifier) read the codebase, configuration files (go.mod, .golangci.yaml), and documentation (CLAUDE.md) from the target project.
- Boundary markers: Content from the target project is processed by subagents without explicit delimiters or instructions to ignore embedded instructions that might be present in the source code or documentation.
- Capability inventory: The orchestration involves subagents utilizing tools to modify the project and execute build/generation commands.
- Sanitization: No explicit sanitization or content validation is performed on the ingested code before processing.
- [COMMAND_EXECUTION]: The skill dispatches subagents that execute shell commands on the target project to perform refactoring and validation as part of its primary functionality.
- The Migrator role executes build-system commands (such as make gen or make mock-gen) defined in the target project to update generated artifacts.
- The Verifier role executes standard Go toolchain commands (go build, go test, go vet) and golangci-lint to verify project integrity.
- [EXTERNAL_DOWNLOADS]: The skill may trigger the retrieval of development tools from official registries during its verification phase.
- The Verifier role utilizes the go tool command to run golangci-lint, which may fetch the linter from the Go package registry if it is not available in the local environment.
Audit Metadata