gathering-migration
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No evidence of behavior overrides, safety bypasses, or instructions to ignore previous rules was found. The skill uses standard instructional language to define a multi-phase migration workflow.
- [DATA_EXFILTRATION]: No hardcoded credentials, sensitive file paths, or network exfiltration patterns were identified. The skill interacts with the local codebase using provided CLI tools.
- [COMMAND_EXECUTION]: The skill utilizes local CLI tools
gf(for searching/grepping) andgw(for git operations). These tools are part of the vendor's expected environment for migration tasks and do not involve arbitrary shell execution of untrusted input. - [REMOTE_CODE_EXECUTION]: No remote script downloads or dynamic execution of external code were found. The skill references other internal skills (
bloodhound-scoutandbear-migrate) as part of its orchestration logic. - [OBFUSCATION]: No obfuscated strings, encoded commands, or hidden characters (such as zero-width spaces or homoglyphs) were detected in the content.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided migration descriptions to define the scope of work. While it lacks explicit sanitization for these descriptions, the resulting actions are performed by specialized sub-agents using local search and version control tools, which is a standard pattern for agentic workflows.
Audit Metadata