go-e2e-tests

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill uses a template-based test data pattern that ingests data from local files, which could be exploited if an attacker can control the content of the template directory.
  • Ingestion points: The sendMessageFromTemplate method in references/fluent-testing-guideline.md reads and parses content from the templates/ directory.
  • Capability inventory: Data generated from these templates is dispatched through network calls (http.Post) and database operations (db.Exec) as demonstrated in the Given and When method examples.
  • Boundary markers: There are no explicit delimiters or instructions provided to the template engine to treat interpolated content as untrusted data.
  • Sanitization: The implementation uses standard Go text/template interpolation, which does not perform automatic contextual escaping or validation for JSON payloads generated in the provided examples.
  • [DYNAMIC_EXECUTION]: The skill implements dynamic generation and execution of data payloads at runtime.
  • Evidence: The skill documentation and implementation guidelines explicitly promote the use of template.ParseFiles and tmpl.Execute to build JSON messages and events dynamically during the test execution cycle.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 10:53 AM
Security Audit — agent-trust-hub — go-e2e-tests