fix-project-leak-from-tc-report
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates test execution by invoking repository-local scripts such as
tests.cmdandrg.cmdvia provided shell scripts (leak-loop.sh,summarize-runs.sh). These operations are consistent with the intended purpose of debugging memory leaks in a development environment. - [DATA_EXFILTRATION]: The scripts access and archive heap dump files (
.hprof.zip) and test output logs to local temporary directories. These actions are performed to facilitate local analysis and do not involve transmission to external network destinations. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it processes untrusted test stdout logs to generate Markdown summaries.
- Ingestion points: The
summarize-runs.shscript reads data from$ARCHIVE/run-*.outputfiles. - Boundary markers: There are no explicit delimiters used to isolate log content from the agent's instructional context.
- Capability inventory: The skill has file-write access (for
SUMMARY.md) and command execution privileges for running build/test scripts. - Sanitization: The script performs basic cleanup by stripping ANSI color codes, though it does not escape the raw retention chain data. The risk is evaluated as safe due to the specialized developer use-case.
Audit Metadata