go-integration-tests

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill documentation and referenced guidelines specify the use of Docker (via testcontainers) and local command runners (just, make) to execute integration and E2E tests. This is a primary function of the skill, requiring environment permissions to manage containers and run shell commands.
  • [INDIRECT_PROMPT_INJECTION]: The testing framework supports a template-based test data pattern that parses files to generate test inputs, creating a surface for potential instruction injection if template sources are untrusted.
  • Ingestion points: Template files are read from the templates/ directory using template.ParseFiles as documented in references/fluent-testing-guideline.md.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are described in the template processing examples.
  • Capability inventory: The skill possesses extensive capabilities including database execution (db.Exec), network requests (http.Client), SQS messaging (sqsClient), and container management (testcontainers.GenericContainer).
  • Sanitization: The provided implementation for sendMessageFromTemplate does not show explicit sanitization or validation of the template content before execution.
  • [CREDENTIALS_UNSAFE]: Code examples in SKILL.md include hardcoded credentials for local testing environments, such as POSTGRES_USER: "test" and POSTGRES_PASSWORD: "test". While appropriate for local development, these represent a pattern of handling sensitive information within the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 10:54 AM
Security Audit — agent-trust-hub — go-integration-tests