sonamu-testing
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and process project test files and configuration data, creating a potential surface where malicious code comments or strings could attempt to influence the agent. Ingestion points include Vitest test files (*.test.ts) and configuration files (vitest.config.ts, sonamu.config.ts, and sonamu.generated.ts). No boundary markers or explicit sanitization procedures for these inputs were identified. The capabilities available to the skill include shell command execution via pnpm and Vitest, and interaction with PostgreSQL databases.
- [COMMAND_EXECUTION]: The skill documentation includes instructions for executing various shell commands to run tests and manage the environment. This includes pnpm test, pnpm sonamu test, and the destructive fixture sync command, which is an intended administrative operation that drops and recreates the test database.
- [DYNAMIC_EXECUTION]: The skill facilitates the dynamic loading and execution of code via Vitest and utilizes a configuration helper, getSonamuTestConfig, to dynamically assemble Vitest settings and environment variables at runtime.
Audit Metadata