bat-adhoc

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python test runner script, tests/uat/run_uat.py, using the uv tool via Bash. This is intended behavior for a testing utility designed to run integration tests for PR validation and regression checks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied natural language scenarios to dynamically generate JSON test payloads. These payloads are then executed by an agent through the test runner. While this involves processing untrusted instructions, it is the primary purpose of the skill as a test automation tool, and the execution is confined to the testing environment.
  • [DATA_EXPOSURE]: The skill writes detailed test results and execution summaries to the /tmp directory. This is standard practice for development workflows to provide debuggable logs and performance metrics.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 09:05 PM