generate-unit-test-code
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (production source code and handoff files) and utilizes file-writing capabilities to generate unit tests. There is a lack of explicit boundary markers or instructions to ignore embedded prompts within the source code, which could lead to the agent following malicious instructions hidden in code comments or metadata.
- Ingestion points: Reads production classes and code-generation handoff files provided in the agent's context (referenced in
SKILL.mdandSETUP.md). - Boundary markers: None identified in the skill instructions.
- Capability inventory: The skill instructs the agent to modify or create Java test files (
src/test/java) and resource files (src/test/resources). - Sanitization: No validation or sanitization of the input source code is requested before generating the test logic.
Audit Metadata