code-testing-extensions

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
  • Command Execution: The skill contains numerous instructions for executing build, test, and linting tools across various ecosystems (e.g., dotnet, pytest, go test, cargo test, npm, rspec). These are standard operations for a testing pipeline but involve executing code within the user's environment.
  • Privilege Escalation: In extensions/cpp.md, the instructions suggest using sudo apt-get install to obtain test frameworks if they are not already present. The use of sudo grants elevated privileges to the package manager, which is a common but sensitive operation in environment setup.
  • External Downloads: The guidance for C++ (extensions/cpp.md) includes CMake FetchContent patterns that download test framework source code from official repositories on GitHub (specifically for GoogleTest and Catch2). These are well-known, trusted sources used to provide required dependencies at build time.
  • Security Configuration: The PowerShell guidance (extensions/powershell.md) mentions the -SkipPublisherCheck flag for Install-Module when updating the Pester testing framework. This flag bypasses certain validation checks and should be used with an understanding of the package source.
  • Repository State Discovery: The skill instructs the agent to analyze the local repository's state using commands like git status, git log, and git ls-files to identify new or untracked files for testing. This allows the agent to gain context about the workspace it is operating in.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 05:47 PM