audit-tests
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: Fetches version metadata for the vendor-owned @intentsolutions/audit-harness package from the official NPM registry to perform freshness checks. The implementation is safe as it only parses the JSON version field using a hardcoded Python script, despite the automated scanner alert.
- [DYNAMIC_EXECUTION]: The bundled crap-score.py script uses the Python subprocess module to execute language-specific complexity tools such as radon or gocyclo based on the detected repository stack. These executions are legitimate diagnostic operations.
- [COMMAND_EXECUTION]: The skill invokes standard development tools including pnpm, pytest, cargo, and go within the target repository to measure test quality and coverage as part of the audit process.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted repository data (feature files, requirement docs) which are processed by specialist sub-agents. This attack surface is mitigated by mandatory hash-pinning of engineer-owned artifacts and human review of generated reports.
Audit Metadata