test-gap-finder
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands including
git merge-base,git diff, andgit grepto analyze the repository state. It also suggests running project-specific test suites such asnpx vitest,pytest, andbundle exec rspecto confirm coverage data. - [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data from the repository's git history and source files.
- Ingestion points: The agent reads outputs from
git diffandgit grep, and parses the contents of source code and test files (SKILL.md). - Boundary markers: There are no explicit markers or instructions defined to prevent the agent from following instructions that might be embedded in the code or diff content it analyzes.
- Capability inventory: The skill utilizes shell command execution and file system read access.
- Sanitization: The instructions do not include steps to sanitize or validate the content of the diffs or code files before the agent processes them.
Audit Metadata