test-strategy-coverage
Warn
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/with_server.pyutilizessubprocess.Popenwithshell=Trueto execute server commands provided via the--serverargument. This pattern is susceptible to command injection if the agent receives untrusted input for these parameters. - [COMMAND_EXECUTION]: Scripts such as
scripts/qa-check.sh,scripts/coverage-report.sh, andscripts/make-verify-run.share designed to identify and execute build and test commands directly from project metadata (e.g.,package.json,Makefile,Cargo.toml). This creates a vulnerability surface where a malicious repository could achieve code execution when audited by the agent. - [REMOTE_CODE_EXECUTION]: The
SKILL.mdfile encourages the installation of additional skills using a script (python scripts/install-external-skills.py). This establishes a pattern for the dynamic installation and execution of external agent skills. - [EXTERNAL_DOWNLOADS]: The
references/mastra-smoke-test.mdfile provides instructions for the agent to usenpx create-mastra, which involves downloading and executing packages from the NPM registry at runtime.
Audit Metadata