mutation-testing

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to run mutation testing tools appropriate for the project language. These include cargo mutants for Rust, npx stryker for JavaScript/TypeScript, mutmut for Python, and mix muzak for Elixir.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing industry-standard mutation testing libraries from official package registries. It also references adding a dependency skill from the author's own repository using npx skills add jwilger/agent-skills.
  • [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface for indirect injection as it processes data from mutation tool reports and local project scenario definitions to generate its recommendations.
  • Ingestion points: Processes output from mutation testing tools (stdout) and reads local project metadata including acceptance_scenarios and domain_scenarios arrays.
  • Boundary markers: The instructions do not specify explicit delimiters or markers to isolate the external tool output from the agent's logic.
  • Capability inventory: The skill can execute shell commands for testing and write structured results to a local file (mutation.json).
  • Sanitization: No explicit sanitization or content validation is performed on the tool output before it is used to generate recommendations.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 06:43 AM