senpi-qa
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill implements a secure isolation strategy by instructing the agent to use a dedicated, temporary directory for testing (
SENPI_CODING_AGENT_DIR), explicitly avoiding modifications to the default~/.senpi/agentdirectory. - [SAFE]: The provided
resolve-evidence-dir.mjsscript uses strict regular expression validation (/^[a-z0-9]+(?:-[a-z0-9]+)*$/) for user-provided slugs, effectively preventing directory traversal attacks and ensuring that artifacts are stored within the repository's sanctioned evidence path. - [COMMAND_EXECUTION]: The skill coordinates the execution of various local test scripts and binaries (
node,bun,senpi) which is the primary intended function of a QA tool. These operations are scoped to the repository's packages and do not involve remote code execution.
Audit Metadata