qe-aqe-v2-v3-migration
Audited by Socket on Feb 27, 2026
1 alert found:
MalwareThis skill file is documentation and operational guidance for migrating an Agentic QE project from v2 to v3. It does not contain embedded malicious code, obfuscated payloads, or direct instructions to exfiltrate secrets. The primary security concerns are standard supply-chain risks: running `npm install`/`npx` will execute code from the package registry (including install scripts), and example flows reference generateEmbedding() which may call external APIs (unspecified). The Task(...) agent-spawning examples introduce potential autonomy concerns if executed by a permissive agent runtime. Overall, the content is coherent with its stated purpose, but operators should treat package install/update steps and any embedding API integrations as sensitive: pin package versions, inspect postinstall scripts, back up v2 data before migration (as recommended), and ensure any subagents or automation run with least privilege and with human approval.