test-provenance-guard
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local command-line utilities to perform its analysis and repair functions. It executes
gitfor version control diffing and state management, and invokes project-specific test runners such asvitest,jest,pytest, andgo test. It also calls build and linting tools liketsc,go build,mypy, andcargo checkto verify the integrity of refactored code.- [DYNAMIC_EXECUTION]: During its mutation check phase, the skill generates temporary stub functions (e.g., returning null or zero) and writes them to production files to simulate logic failure. This represents a dynamic modification and execution of code strings, which is used here for the purpose of verifying that tests are sensitive to logic changes.- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes source code and test file content from the local project, which serves as a potential surface for indirect prompt injection. The skill addresses this risk through deterministic static analysis patterns and a mandatory confidence evaluation requirement (gated at 90%) before any autonomous code modification is performed.- [SAFE]: The skill implements industry-standard safety measures for its modification tasks, including the use ofmktempandcpfor non-destructive file backups instead of risky stashing operations. It also enforces a strict restoration routine that compares the post-run state to a recorded pre-diff to ensure the working tree is returned to its original state regardless of the outcome of the test run.
Audit Metadata