skills/microsoft/testfx/test-tagging/Gen Agent Trust Hub

test-tagging

Pass

Audited by Gen Agent Trust Hub on Aug 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • Standard Command Execution: The skill involves executing common development commands like dotnet build, pytest --collect-only, and mvn test-compile to validate changes and discover tests. These operations are performed as part of a typical development workflow to ensure project integrity.
  • Automated Source Editing: The skill includes functionality to automatically modify source files by adding framework-specific attributes (e.g., [TestCategory], @pytest.mark). This direct interaction with codebase files is necessary for its primary function of tagging tests.
  • Indirect Prompt Injection Surface: The skill analyzes user-provided source code (method names, assertions, comments) to classify tests. This processing of external, untrusted content represents a surface where specifically crafted code could theoretically influence the classification logic, although the use of a fixed taxonomy serves as a mitigation.
  • Ingestion points: Reads test files and project configuration to detect language, framework, and test methods (Step 1, Step 2).
  • Boundary markers: None explicitly defined for the ingested code content.
  • Capability inventory: Modifies source files (auto-edit) and executes shell commands for project validation (Validation section).
  • Sanitization: Relies on specific heuristics and a predefined taxonomy to determine appropriate tags.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 23, 2026, 12:34 AM
Security Audit — agent-trust-hub — test-tagging