lovable-testing
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from test plans, profiles, and results within the
.lovable-agent/directory, which serves as a potential vector for indirect instructions. - Ingestion points: Files located in
.lovable-agent/tests/plans/,.lovable-agent/tests/profiles/, and.lovable-agent/tests/results/are read into the agent context. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when handling these files.
- Capability inventory: The skill allows for the execution of a migration script (
scripts/migrate-workspace.py) and modification of project configurations. - Sanitization: No sanitization or validation logic is defined for the content of the processed test artifacts.
- [COMMAND_EXECUTION]: The skill requires the agent to execute a Python script (
scripts/migrate-workspace.py) to perform workspace migration, involving local shell execution.
Audit Metadata