go-integration-tests
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation and referenced guidelines specify the use of Docker (via
testcontainers) and local command runners (just,make) to execute integration and E2E tests. This is a primary function of the skill, requiring environment permissions to manage containers and run shell commands. - [INDIRECT_PROMPT_INJECTION]: The testing framework supports a template-based test data pattern that parses files to generate test inputs, creating a surface for potential instruction injection if template sources are untrusted.
- Ingestion points: Template files are read from the
templates/directory usingtemplate.ParseFilesas documented inreferences/fluent-testing-guideline.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are described in the template processing examples.
- Capability inventory: The skill possesses extensive capabilities including database execution (
db.Exec), network requests (http.Client), SQS messaging (sqsClient), and container management (testcontainers.GenericContainer). - Sanitization: The provided implementation for
sendMessageFromTemplatedoes not show explicit sanitization or validation of the template content before execution. - [CREDENTIALS_UNSAFE]: Code examples in
SKILL.mdinclude hardcoded credentials for local testing environments, such asPOSTGRES_USER: "test"andPOSTGRES_PASSWORD: "test". While appropriate for local development, these represent a pattern of handling sensitive information within the skill instructions.
Audit Metadata