prompt-engineer-toolkit
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/prompt_tester.pyutility supports an optional--runner-cmdargument to execute external CLI tools for prompt evaluation. The implementation usesshlex.splitand passes arguments as a list tosubprocess.run, effectively preventing shell injection attacks while providing the intended functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes prompt definitions and test cases that may be sourced from external files or user input.
- Ingestion points: Prompt content is read from files (
--prompt-a-file,--prompt-b-file) or provided via CLI arguments, and test cases are loaded from JSON files (--cases-file) inscripts/prompt_tester.py. - Boundary markers: The tool does not implement specific boundary markers between prompt templates and test case data within the testing script.
- Capability inventory: The skill possesses command execution capabilities through
subprocess.runto call external evaluators. - Sanitization: Input data is handled as strings and passed as arguments to sub-processes;
shlex.splitensures that input data cannot break out of the command structure into the system shell.
Audit Metadata