gauge-skill
Fail
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Gauge automation framework installation script from its official domain (downloads.gauge.org) and installs the CLI using npm. These are standard installation methods for this well-known testing tool.\n- [COMMAND_EXECUTION]: Utilizes the gauge CLI to initialize projects, manage plugins, and run test suites.\n- [INDIRECT_PROMPT_INJECTION]: The skill generates executable code and test steps from Markdown-formatted specifications, which could be exploited if the input data is sourced from an untrusted party.\n
- Ingestion points: Test specification (.spec) and concept (.cpt) files processed in SKILL.md and playbook.md.\n
- Boundary markers: None; the skill uses standard Markdown headings and bullet points to define logic.\n
- Capability inventory: Writing test implementation files to disk, executing shell commands via the gauge runner, and performing network operations through Selenium WebDriver.\n
- Sanitization: None; the agent is expected to translate specification text directly into code implementations.\n- [DYNAMIC_EXECUTION]: Generates language-specific step implementations (in Java, Python, JavaScript, etc.) from Markdown specifications for execution by the Gauge framework.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata