test-provenance-guard
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local development tools, including test runners (Vitest, Jest, Go test, Pytest) and build compilers (TSC, Go build, Mypy, Cargo check), to verify code integrity during mutation testing and refactoring. These commands are scoped to the project environment and are necessary for the skill's primary functionality.
- [DYNAMIC_EXECUTION]: The skill performs runtime modification of production source code to conduct mutation testing (sabotage) and automated refactoring (self-healing). The risk of permanent code corruption is mitigated by the mandatory use of
git stashfor snapshots andgit restorefor cleanup. The self-healing logic is further restricted by a required confidence threshold (≥ 90%) and a verification phase that ensures the refactor remains build-safe. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by reading and analyzing project source code and test files. There is a theoretical surface for indirect injection if a malicious file contains patterns designed to manipulate the extraction logic; however, the skill focuses on structural parsing (imports, exports, signatures) and includes post-execution verification steps to confirm the expected behavior change.
Audit Metadata