code-testing-extensions
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
- Command Execution: The skill contains numerous instructions for executing build, test, and linting tools across various ecosystems (e.g.,
dotnet,pytest,go test,cargo test,npm,rspec). These are standard operations for a testing pipeline but involve executing code within the user's environment. - Privilege Escalation: In
extensions/cpp.md, the instructions suggest usingsudo apt-get installto obtain test frameworks if they are not already present. The use ofsudogrants elevated privileges to the package manager, which is a common but sensitive operation in environment setup. - External Downloads: The guidance for C++ (
extensions/cpp.md) includes CMakeFetchContentpatterns that download test framework source code from official repositories on GitHub (specifically for GoogleTest and Catch2). These are well-known, trusted sources used to provide required dependencies at build time. - Security Configuration: The PowerShell guidance (
extensions/powershell.md) mentions the-SkipPublisherCheckflag forInstall-Modulewhen updating the Pester testing framework. This flag bypasses certain validation checks and should be used with an understanding of the package source. - Repository State Discovery: The skill instructs the agent to analyze the local repository's state using commands like
git status,git log, andgit ls-filesto identify new or untracked files for testing. This allows the agent to gain context about the workspace it is operating in.
Audit Metadata