add-e2e-test
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The instructions mandate the use of
readBootstrap()and theSEEDEDconstant for accessing credentials and entity IDs, explicitly prohibiting hardcoded API keys and sensitive literals. - [SAFE]: The skill enforces environment isolation by instructing the agent not to spread
process.envinto test execution, preventing the accidental leakage of developer shell environment variables (e.g., METABASE_*) into the test run. - [SAFE]: The 'Self-grep' section provides a suite of ripgrep commands for the agent to verify its own work, specifically looking for and blocking insecure patterns such as direct use of
execa/fetch, hardcoded credentials, and unsafe environment variable handling. - [SAFE]: Instructions for handling license tokens emphasize that tokens must be treated as opaque values, with verification limited to existence checks and prohibiting any logging, snapshotting, or assertion of the actual token value.
- [SAFE]: The skill uses project-standard tools (Bun, Vitest) and sanctioned internal wrappers (
runCli,parseJson) which is consistent with legitimate development workflows for the Metabase vendor.
Audit Metadata