test-run
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFE
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses
!findand!grepcommands within theContextsection to identify project files and test configurations. - These commands are restricted to the top-level directory (
-maxdepth 1). - They target standard configuration files like
package.json,pyproject.toml,Cargo.toml, andgo.modto gather necessary execution context. - This is a legitimate use case for a developer tool to provide relevant environment information to the sub-agent.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to parse output from various test frameworks and configuration files, which presents a surface for indirect prompt injection.
- The instructions explicitly ask the
test-runneragent to parse test output for pass/fail counts and error messages. - The risk is mitigated by the specific instruction set which directs the agent toward structured analysis (pass/fail/duration) rather than arbitrary execution based on the output.
Audit Metadata