repo-test-audit
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for the read-only inventory of test files and CI configurations (justfile) within a local repository root.
- [DATA_EXPOSURE]: The included Python script (
scripts/inventory_tests.py) reads local file contents to detect the presence of assertions (searching for the string 'assert'). It does not perform any network operations, use external APIs, or exfiltrate data. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a local repository. While this constitutes an attack surface, the risk is mitigated by instructions that enforce an audit-only mode by default and explicitly forbid editing product code without user request.
- [COMMAND_EXECUTION]: The skill executes a local Python script for inventory. The script logic is transparent, uses only Python standard libraries, and handles paths using relative resolution and basic directory traversal checks.
Audit Metadata