mutation-testing
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to run mutation testing tools appropriate for the project language. These include
cargo mutantsfor Rust,npx strykerfor JavaScript/TypeScript,mutmutfor Python, andmix muzakfor Elixir. - [EXTERNAL_DOWNLOADS]: The skill recommends installing industry-standard mutation testing libraries from official package registries. It also references adding a dependency skill from the author's own repository using
npx skills add jwilger/agent-skills. - [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface for indirect injection as it processes data from mutation tool reports and local project scenario definitions to generate its recommendations.
- Ingestion points: Processes output from mutation testing tools (stdout) and reads local project metadata including
acceptance_scenariosanddomain_scenariosarrays. - Boundary markers: The instructions do not specify explicit delimiters or markers to isolate the external tool output from the agent's logic.
- Capability inventory: The skill can execute shell commands for testing and write structured results to a local file (
mutation.json). - Sanitization: No explicit sanitization or content validation is performed on the tool output before it is used to generate recommendations.
Audit Metadata