framework-migration-code-migrate
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides legitimate code patterns and guidance for migration experts. All functions, including the analysis and planning modules, align with the tool's intended use case without any suspicious or hidden activities.
- [COMMAND_EXECUTION]: The skill provides Python scripts designed for codebase analysis, involving directory traversal and file reading via the pathlib and os libraries. These capabilities are required to assess migration complexity and are functionally restricted to the source path provided by the user.
- [PROMPT_INJECTION]: The skill processes untrusted codebases and user-provided requirements ($ARGUMENTS), which introduces an indirect prompt injection surface. However, this is inherent to the nature of a code migration and analysis tool. Mandatory Evidence: (1) Ingestion points: The MigrationAnalyzer reads files from the file system, and user inputs are interpolated into requirements. (2) Boundary markers: No specific delimiters are used to wrap external content. (3) Capability inventory: The skill performs file reads and generates new migration scripts based on its analysis. (4) Sanitization: The logic utilizes the standard AST library for structural code analysis.
- [EXTERNAL_DOWNLOADS]: The skill's progress monitoring dashboard includes a reference to Chart.js hosted on the jsdelivr CDN. This is a well-known and widely used service for loading open-source libraries and is considered a safe resource reference.
Audit Metadata