test-with-spanner
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's instructions require the agent to take input from the user (specifically a "package path" and an "optional test name") and use them to construct and execute a shell command. Evidence: In SKILL.md steps 2 and 3, the instructions show
go test -v ./package/path -run TestName. Direct interpolation of user-controlled strings into shell commands without explicit sanitization instructions constitutes a command injection risk. - [DATA_EXFILTRATION]: The skill reads the environment variables
SPANNER_EMULATOR_HOSTandSTORJ_TEST_SPANNER. However, these are used locally to interface with thespanner_emulatortool on the loopback address (127.0.0.1) and do not involve exfiltration to external or untrusted domains.
Audit Metadata