qa-test-plan
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from external sources such as pull requests, commits, and local git diffs to generate a structured QA test plan. This creates a surface for indirect prompt injection where an attacker could embed malicious instructions within a diff or ticket body to manipulate the resulting plan.
- Ingestion points: As specified in
SKILL.md, the skill accepts ticket envelopes, acceptance criteria, frozen diffs, PRs, commits, and local diffs. - Boundary markers: The skill employs character normalization and intake size limits but lacks explicit delimiters or instructions to ignore embedded prompts within the ingested diffs.
- Capability inventory: Although the skill explicitly states it does not execute code, it generates structured QA plans containing shell commands for automated checks, which may be executed by downstream agents.
- Sanitization: No specific prompt-level sanitization or escaping of ingested data is described beyond byte-level normalization.
Audit Metadata