migrate-project

Pass

Audited by Gen Agent Trust Hub on Jun 29, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it ingests and analyzes the contents of a user-provided target repository.
  • Ingestion points: Specialized subagents (Analyzer, Mapper, Migrator, and Verifier) read the codebase, configuration files (go.mod, .golangci.yaml), and documentation (CLAUDE.md) from the target project.
  • Boundary markers: Content from the target project is processed by subagents without explicit delimiters or instructions to ignore embedded instructions that might be present in the source code or documentation.
  • Capability inventory: The orchestration involves subagents utilizing tools to modify the project and execute build/generation commands.
  • Sanitization: No explicit sanitization or content validation is performed on the ingested code before processing.
  • [COMMAND_EXECUTION]: The skill dispatches subagents that execute shell commands on the target project to perform refactoring and validation as part of its primary functionality.
  • The Migrator role executes build-system commands (such as make gen or make mock-gen) defined in the target project to update generated artifacts.
  • The Verifier role executes standard Go toolchain commands (go build, go test, go vet) and golangci-lint to verify project integrity.
  • [EXTERNAL_DOWNLOADS]: The skill may trigger the retrieval of development tools from official registries during its verification phase.
  • The Verifier role utilizes the go tool command to run golangci-lint, which may fetch the linter from the Go package registry if it is not available in the local environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 29, 2026, 10:03 AM
Security Audit — agent-trust-hub — migrate-project