modernize-move
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a legitimate utility designed for Move language refactoring. It adheres to security best practices by requiring functional test verification and explicit user approval before performing any modifications to the codebase.
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to executeaptos move testandaptos move test --coverage. This is a standard and expected operation for a Move developer tool to verify the integrity and behavior of the smart contracts being refactored. TheaptosCLI is the official, well-known tool for this ecosystem. - [PROMPT_INJECTION]: The skill processes untrusted Move source code files, which presents an indirect prompt injection surface (Category 8). The skill manages this risk through a documented multi-stage safety workflow: 1. Ingestion points: .move files located in the
sources/directory (SKILL.md). 2. Boundary markers: The process includes a mandatory Analysis Report and a GATE 1 user confirmation step before modifications (SKILL.md). 3. Capability inventory: The skill has access toRead,Write,Edit, andBashtools (SKILL.md). 4. Sanitization: Modifications are verified against a local test baseline using theaptosCLI, ensuring the agent's changes remain functionally constrained.
Audit Metadata