qa-automation
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
bashto manage the QA environment lifecycle viastack upandstack downcommands, and to execute the test suite. - [COMMAND_EXECUTION]: A local Python script
workflows/validate_tasks.pyis invoked to validate the integrity and schema of the generatedtasks.jsonconfiguration file. - [EXTERNAL_DOWNLOADS]: The skill can delegate test generation to external skills (such as those provided by Anthropics) based on settings in the local
skills.config.yamlfile. - [PROMPT_INJECTION]: The skill processes untrusted user data including
featuredescriptions andacceptance_criteriato derive test cases. - Ingestion points:
acceptance_criteria,feature, andcontract_summaryinputs (SKILL.md). - Boundary markers: None explicitly defined for input interpolation, though the skill instructions mandate following strict QA standards.
- Capability inventory: Subprocess execution via
stack,bash, andpython3; file system writes for test specs and configuration (SKILL.md). - Sanitization: The skill includes a 'No weakened assertions' standard and configuration-level freezes (
gates.freeze_approved_tests) to prevent adversarial manipulation of test outcomes.
Audit Metadata