qa-locust-writer
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests test case specifications and performance plans from other skills or external documents to generate executable Python scripts (
locustfile.py). - Ingestion points: Performance plans and test case specifications provided as input to the generation process (e.g., from
qa-plan-creator,qa-nfr-analyst, orqa-testcase-from-docs). - Boundary markers: The workflow lacks explicit boundary markers or "ignore embedded instructions" directives when interpolating external content into the generated scripts.
- Capability inventory: The skill generates Python source code and configuration files (
locustfile.py,locust.conf). It does not autonomously execute the generated code. - Sanitization: The quality checklist mandates avoiding hardcoded secrets and using environment variables, but does not specify logic for sanitizing or escaping the content of the specifications themselves.
Audit Metadata