quality-test-implementation
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and acts upon untrusted data from external repositories provided via the REPO_NAME input.
- Ingestion points: Target repository source code and build configuration files (pom.xml, build.gradle, pyproject.toml) referenced in SKILL.md.
- Boundary markers: None; the skill does not instruct the agent to ignore or delimit embedded instructions within the ingested repository files.
- Capability inventory: The skill executes build and test tools like dotnet, mvn, gradlew, and pytest, which are capable of running code and scripts defined in the target repository.
- Sanitization: No validation or sanitization is performed on the repository content or build scripts before they are executed.
- [COMMAND_EXECUTION]: The skill utilizes a shell-based dispatcher script (references/run-coverage.sh) and several CLI tools (e.g., ruff, bandit, snyk, dotnet) to perform static analysis and coverage measurement.
- [EXTERNAL_DOWNLOADS]: The skill fetches standard development utilities and packages from official registries using pip and dotnet tool managers as part of the environment preparation.
Audit Metadata