test-provenance-guard

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes local development tools, including test runners (Vitest, Jest, Go test, Pytest) and build compilers (TSC, Go build, Mypy, Cargo check), to verify code integrity during mutation testing and refactoring. These commands are scoped to the project environment and are necessary for the skill's primary functionality.
  • [DYNAMIC_EXECUTION]: The skill performs runtime modification of production source code to conduct mutation testing (sabotage) and automated refactoring (self-healing). The risk of permanent code corruption is mitigated by the mandatory use of git stash for snapshots and git restore for cleanup. The self-healing logic is further restricted by a required confidence threshold (≥ 90%) and a verification phase that ensures the refactor remains build-safe.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by reading and analyzing project source code and test files. There is a theoretical surface for indirect injection if a malicious file contains patterns designed to manipulate the extraction logic; however, the skill focuses on structural parsing (imports, exports, signatures) and includes post-execution verification steps to confirm the expected behavior change.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 11:46 AM
Security Audit — agent-trust-hub — test-provenance-guard