swe-test-planner
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local codebase, including file names, file content, and git commit history. This creates an attack surface where malicious instructions embedded in the scanned repository could attempt to override the agent's logic or influence the generated test plan.
- Ingestion points: File paths discovered via directory listing in
SKILL.md(Step 1), file contents read for dependency detection inreferences/heuristics.md, and git log output parsed for likelihood scoring inSKILL.md(Step 3). - Boundary markers: Absent. The instructions do not define clear delimiters or instruct the agent to ignore instructions found within the data it scans.
- Capability inventory:
RunCommand(for git/grep),ReadFile,ListDirectory, andAskUserQuestion. - Sanitization: Absent. The skill does not specify any sanitization or validation of the input strings harvested from the codebase.
- [COMMAND_EXECUTION]: The skill uses the
RunCommandtool to perform repository analysis using commands likegit logandgrep. While these are standard developer tools, executing shell commands on potentially untrusted file paths or content presents a theoretical risk if the agent fails to properly escape arguments.
Audit Metadata