manual-testing-node-js
Warn
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes shell commands for package management (npm, yarn, pnpm), infrastructure management (Docker), and blockchain interactions (SUI CLI) based on project-specific configuration files. Evidence found in Sections 1, 2, and 4.
- [COMMAND_EXECUTION]: Generates and executes dynamic JavaScript code snippets via the node -e flag to verify database state during test execution. Evidence found in Section 4.1.
- [CREDENTIALS_UNSAFE]: Actively identifies and processes sensitive keys and mnemonics (e.g., PRIVATE_KEY, SECRET_KEY) within environment configuration files to assist in setup and key regeneration. Evidence found in Sections 1.3 and 1.4.
- [PROMPT_INJECTION]: Vulnerable to indirect prompt injection because it interprets untrusted repository data such as package.json scripts to determine its actions.
- Ingestion points: package.json, .env.example, Move.toml, and codebase grepping.
- Boundary markers: Not specified in the instructions.
- Capability inventory: Shell command execution, file system modifications, and background process management.
- Sanitization: Includes specific instructions to mask full secret values before logging or echoing.
Audit Metadata