test-tagging
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- Standard Command Execution: The skill involves executing common development commands like
dotnet build,pytest --collect-only, andmvn test-compileto validate changes and discover tests. These operations are performed as part of a typical development workflow to ensure project integrity. - Automated Source Editing: The skill includes functionality to automatically modify source files by adding framework-specific attributes (e.g.,
[TestCategory],@pytest.mark). This direct interaction with codebase files is necessary for its primary function of tagging tests. - Indirect Prompt Injection Surface: The skill analyzes user-provided source code (method names, assertions, comments) to classify tests. This processing of external, untrusted content represents a surface where specifically crafted code could theoretically influence the classification logic, although the use of a fixed taxonomy serves as a mitigation.
- Ingestion points: Reads test files and project configuration to detect language, framework, and test methods (Step 1, Step 2).
- Boundary markers: None explicitly defined for the ingested code content.
- Capability inventory: Modifies source files (
auto-edit) and executes shell commands for project validation (Validation section). - Sanitization: Relies on specific heuristics and a predefined taxonomy to determine appropriate tags.
Audit Metadata