testing-expert

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous shell commands for environment discovery and test validation. It uses node -e to parse project dependencies, find to locate test specifications, and grep to identify configuration patterns. It also defines commands for running test suites using standard tools like npm, npx jest, npx vitest, and npx playwright. These are legitimate operations for a development-focused skill.
  • [DYNAMIC_EXECUTION]: The skill utilizes node -e to execute a small, hardcoded script that extracts package names from the local package.json. This dynamic execution is scoped to environment detection and does not incorporate untrusted external input.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from the local filesystem to adapt its testing strategies.
  • Ingestion points: Reads package.json (via node/grep), searches through src/ directories (via grep), and identifies *.test.* or *.spec.* files (via find).
  • Boundary markers: The instructions do not define explicit delimiters or warnings to ignore instructions embedded within the files being scanned.
  • Capability inventory: The skill possesses Read, Edit, Bash, Grep, and Glob capabilities, allowing it to modify files and execute shell commands based on the context it gathers.
  • Sanitization: There is no explicit sanitization or validation of the content found within project files before it is processed by the agent's logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 02:37 PM