rp-execute-import
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes generated Node.js artifacts (e.g.,
node src/run-import.js) to perform the data migration. This is the intended core capability of the migration pipeline. - [CREDENTIALS_SAFE]: The instructions identify
migrations/<project>/config/*.envfiles as secret-bearing and explicitly prohibit the agent from performing whole-file reads that would print contents into tool output. Instead, it must only verify the existence and status of required keys. - [DYNAMIC_EXECUTION]: The skill runs generated JavaScript entrypoints located within the project directory. This behavior is consistent with the skill's purpose of executing a previously generated migration artifact.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from migration plans and generated code. It implements a strong mitigation by requiring the agent to present an 'execution plan report' and obtain explicit human acceptance before any writes to the target site are executed.
- [SAFE]: Network operations are directed to official Wix API domains (
www.wixapis.com) using real credentials, aligning with the expected behavior of the vendor's tool.
Audit Metadata