qa-qase-integration
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard development commands like
npm testandnpx qase-apito execute test suites and upload results. These are standard operations for CI/CD integration. - [EXTERNAL_DOWNLOADS]: The skill references official Qase.io reporters and GitHub Actions (
qase-io/qase-report-action). These are well-known resources for integrating with the Qase.io platform. - [DATA_EXFILTRATION]: The skill transmits test results and case metadata to the official Qase.io API (
api.qase.io). This is the primary intended function of the skill and uses official endpoints. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data formats such as JUnit XML and Markdown files which could theoretically contain malicious instructions.
- Ingestion points: Reads local test cases (Markdown/JSON) and JUnit XML results.
- Boundary markers: None explicitly defined in the provided templates.
- Capability inventory: Network POST/PATCH requests to the Qase.io API to update test cases and runs.
- Sanitization: The skill maps external data to specific structured JSON fields and integer enums (Priority, Severity, Type) for the Qase API, providing validation against free-text injection.
Audit Metadata