go-e2e-tests
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses a template-based test data pattern that ingests data from local files, which could be exploited if an attacker can control the content of the template directory.
- Ingestion points: The
sendMessageFromTemplatemethod inreferences/fluent-testing-guideline.mdreads and parses content from thetemplates/directory. - Capability inventory: Data generated from these templates is dispatched through network calls (
http.Post) and database operations (db.Exec) as demonstrated in theGivenandWhenmethod examples. - Boundary markers: There are no explicit delimiters or instructions provided to the template engine to treat interpolated content as untrusted data.
- Sanitization: The implementation uses standard Go
text/templateinterpolation, which does not perform automatic contextual escaping or validation for JSON payloads generated in the provided examples. - [DYNAMIC_EXECUTION]: The skill implements dynamic generation and execution of data payloads at runtime.
- Evidence: The skill documentation and implementation guidelines explicitly promote the use of
template.ParseFilesandtmpl.Executeto build JSON messages and events dynamically during the test execution cycle.
Audit Metadata