review-testing
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted external files from a target repository to produce testing fitness scores and reports.
- Ingestion points: The agent reads source code, test files, and CI configuration files (such as .github/workflows/, package.json, and Jenkinsfile) across multiple languages as part of the scope and inventory workflow.
- Boundary markers: Absent. The instructions do not provide delimiters or specific guidance to ignore instructions or control sequences embedded within the codebase being analyzed.
- Capability inventory: The skill involves executing shell commands (pytest, go test, mix, npx jest) and writing report files to the local docs/ directory.
- Sanitization: Absent. The agent is instructed to read and interpret the content of untrusted source files directly to assess quality and coverage.
- [COMMAND_EXECUTION]: The skill requires the agent to execute local command-line tools and scripts to collect metadata and resolve configuration.
- Evidence: The agent is instructed to invoke a local resolver script using python3 at a path relative to the skill directory.
- Evidence: The agent runs various language-specific test collectors, including pytest --collect-only, go test -list, and npx jest --listTests, to inventory the test pyramid.
Audit Metadata