dev-test
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to run git commands for identifying code changes and to execute test runners like Vitest or pytest. These operations are core to the skill's purpose and are conducted with user oversight.
- [EXTERNAL_DOWNLOADS]: The skill identifies missing test frameworks and offers to install them via standard package managers (npm, pnpm, pip). It requires user approval before performing any installations and targets well-known software registries.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the project's codebase and documentation to generate relevant tests.
- Ingestion points: The skill reads uncommitted source code and architectural documentation files (e.g., architecture.md, project-overview.md) using file system tools.
- Boundary markers: No specific delimiters or "ignore" instructions are provided for the ingested data.
- Capability inventory: The skill has access to Bash, Write, and Edit tools for creating and running tests.
- Sanitization: The skill does not explicitly mention sanitization of the code content it analyzes.
- [SAFE]: The skill provides positive security guidance by instructing the agent to specifically test authentication, authorization, and secret handling to ensure sensitive data does not leak into logs.
Audit Metadata