test-tagging
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to utilize local development and build tools (e.g.,
dotnet build,pytest --collect-only,mvn test-compile,go vet) to verify that added test tags do not break the project's build or discovery process. It also provides fallback instructions to use standard shell commands likecat,sed, orGet-Contentfor reading and writing files if primary agent tools encounter environment-specific path or transport issues. - [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface where untrusted data is processed with write and execute capabilities.
- Ingestion points: Test files and project structures from the local workspace.
- Boundary markers: The instructions lack explicit boundary markers or warnings to ignore embedded instructions in the ingested code.
- Capability inventory: The agent has the ability to write to source files (tagging) and execute shell commands/build tools (verification).
- Sanitization: No explicit sanitization of external content is mentioned before processing.
Audit Metadata