bat-adhoc
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python test runner script,
tests/uat/run_uat.py, using theuvtool viaBash. This is intended behavior for a testing utility designed to run integration tests for PR validation and regression checks. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied natural language scenarios to dynamically generate JSON test payloads. These payloads are then executed by an agent through the test runner. While this involves processing untrusted instructions, it is the primary purpose of the skill as a test automation tool, and the execution is confined to the testing environment.
- [DATA_EXPOSURE]: The skill writes detailed test results and execution summaries to the
/tmpdirectory. This is standard practice for development workflows to provide debuggable logs and performance metrics.
Audit Metadata