hmos-local-test
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the 'hvigorw' tool to execute tests. This command execution is performed through a Python script using list-based arguments with 'subprocess.run', which effectively mitigates the risk of shell injection.
- [EXTERNAL_DOWNLOADS]: The skill requires the 'json5' Python library to parse project configuration files. This is a standard and legitimate dependency for HarmonyOS development environments.
- [PROMPT_INJECTION]: The skill instructs the agent to read and interpret project files (such as 'build-profile.json5' and '*.test.ets') to determine the test scope, which represents a surface for indirect prompt injection.
- Ingestion points: The agent reads configuration and source files from the user-provided project directory.
- Boundary markers: No specific markers are used to distinguish file content from the agent's instructions.
- Capability inventory: The skill has the ability to read project files and execute build commands via the provided Python script.
- Sanitization: The execution script uses safe command construction, ensuring that data extracted from files cannot lead to shell command injection.
Audit Metadata