gathering-migration

Pass

Audited by Gen Agent Trust Hub on Mar 15, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: No evidence of behavior overrides, safety bypasses, or instructions to ignore previous rules was found. The skill uses standard instructional language to define a multi-phase migration workflow.
  • [DATA_EXFILTRATION]: No hardcoded credentials, sensitive file paths, or network exfiltration patterns were identified. The skill interacts with the local codebase using provided CLI tools.
  • [COMMAND_EXECUTION]: The skill utilizes local CLI tools gf (for searching/grepping) and gw (for git operations). These tools are part of the vendor's expected environment for migration tasks and do not involve arbitrary shell execution of untrusted input.
  • [REMOTE_CODE_EXECUTION]: No remote script downloads or dynamic execution of external code were found. The skill references other internal skills (bloodhound-scout and bear-migrate) as part of its orchestration logic.
  • [OBFUSCATION]: No obfuscated strings, encoded commands, or hidden characters (such as zero-width spaces or homoglyphs) were detected in the content.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided migration descriptions to define the scope of work. While it lacks explicit sanitization for these descriptions, the resulting actions are performed by specialized sub-agents using local search and version control tools, which is a standard pattern for agentic workflows.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 15, 2026, 03:49 PM