tdd-test-generator
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains a vulnerability to indirect prompt injection through its script generation logic.\n
- Ingestion points: The script
scripts/gen_pytest.pyingests untrusted data through command-line argumentsfilenameandfunction_nameviasys.argv.\n - Boundary markers: No delimiters or instructions are present to prevent the agent from obeying instructions embedded in the provided names.\n
- Capability inventory: The skill has file-writing capabilities through the
open().write()operation inscripts/gen_pytest.py.\n - Sanitization: There is no evidence of sanitization, escaping, or validation of the input arguments before they are interpolated into the generated Python code or used in file path construction.\n- [COMMAND_EXECUTION]: The file
scripts/gen_pytest.pyperforms dynamic code generation by assembling Python source code via string concatenation. It writes this content to the file system as a new script, which represents the creation of executable content based on runtime inputs.
Audit Metadata