grade-tests
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill processes external, potentially untrusted code (test methods, bodies, and production code) to perform its analysis. This introduces a surface where malicious instructions could be embedded within the data to influence the AI's grading output.
- Ingestion points: SKILL.md identifies that test bodies and production code are read into the agent's context.
- Boundary markers: There is an absence of explicit boundary markers or specific instructions to the agent to ignore embedded commands within the ingested code sections.
- Capability inventory: The skill possesses the capability to read local files and invoke other analysis skills (test-analysis-extensions, test-gap-analysis).
- Sanitization: The instructions do not detail any sanitization or filtering of the code content before it is processed.
Audit Metadata