typo3-testing
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses several utility scripts to orchestrate the development lifecycle.
- The
runTests.shscript automates Docker container execution for running PHPUnit, PHP-CS-Fixer, and Playwright tests. - The
setup-testing.shandgenerate-test.shscripts manage project initialization and boilerplate generation using standard shell commands. - [EXTERNAL_DOWNLOADS]: The skill references several external resources for its infrastructure.
- It pulls Docker images from official repositories such as
ghcr.io/typo3andmcr.microsoft.com/playwright. - It utilizes standard package managers (Composer and NPM) to fetch development dependencies from well-known registries.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a large surface for processing external data during the testing process.
- It ingest untrusted content from CSV fixtures and code files when performing automated assessments or running tests.
- The documentation includes guidance on using boundary markers and sanitization, which effectively mitigates common injection risks in this context.
Audit Metadata