testsprite-ai-testing-cli
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
@testsprite/testsprite-clipackage from the official npm registry, which is a well-known and trusted service for software distribution. - [DATA_EXFILTRATION]: The CLI manages its own configuration and authentication data at
~/.testsprite/credentials. This access is standard for CLI tools maintaining local state and does not constitute unauthorized data exposure. - [CREDENTIALS_UNSAFE]: The skill facilitates authentication with the TestSprite service using API keys. It follows security best practices by supporting environment variables for secrets and providing built-in commands for manual configuration and logout.
- [COMMAND_EXECUTION]: The skill uses the
testspriteutility to perform testing operations and install agent instruction files. These commands are transparently documented and align with the skill's stated purpose of enabling automated testing loops. - [PROMPT_INJECTION]: The skill includes an indirect prompt injection surface by ingesting failure bundles (e.g.,
failure.json) from the TestSprite API. Ingestion point:.testsprite/failure/failure.json. Boundary markers: None. Capability inventory:npm install, file-write (test code put), and shell command execution. Sanitization: Not specified. While an attacker controlling test outputs could attempt to influence the agent, this is a low-risk scenario inherent to AI-assisted debugging workflows.
Audit Metadata