add-e2e-test

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the agent to execute development tools such as bun and rg (ripgrep) to build, run, and verify tests. It also uses a project-specific wrapper, runCli, to execute the CLI binary (packages/cli/dist/cli.mjs) in a controlled manner.
  • [CREDENTIALS_SAFE]: The instructions implement strong protections against credential exposure by explicitly forbidding hardcoded API keys. It mandates that all authentication data be retrieved through a readBootstrap utility and used only within the test runtime.
  • [DATA_EXFILTRATION]: The skill enforces environment isolation by prohibiting the leakage of process.env into the test execution context. It specifically forbids direct network calls like fetch and requires an isolated XDG_CONFIG_HOME for each test to prevent data from persisting or being shared across sessions.
  • [INDIRECT_PROMPT_INJECTION]: The skill includes an ingestion surface where the agent is instructed to read existing project files and harness modules to understand the testing context. To mitigate risks, the skill includes a mandatory 'Self-grep' verification step (Step N-1) to ensure the generated code adheres to security boundaries and does not contain unauthorized patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 02:38 PM
Security Audit — agent-trust-hub — add-e2e-test