generate-bat-tests
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The environment validation script
scripts/validate_prerequisites.shprovides an installation command for the BAT CLI usingcurl | bashfromhttps://s3.amazonaws.com/bat-wrapper/install.sh. This pattern involves downloading and executing a remote script from a well-known cloud provider to install a required vendor tool. - [COMMAND_EXECUTION]: The skill involves the generation of a local shell runner (
run-bat.sh) which executes thebatCLI. It also uses theBashtool to execute several utility scripts provided with the skill for endpoint extraction and suite scaffolding. The generated runner includes specific JVM options required for the tool to function on Java 17+. - [PROMPT_INJECTION]: An indirect prompt injection surface exists where the skill reads and parses local project files such as Mule XML and API specifications. These inputs influence the generation of executable DataWeave tests. The skill implements a mandatory human-in-the-loop approval step to review the proposed test inventory before any files are generated or executed.
- [CREDENTIALS_UNSAFE]: The skill facilitates the use of API bearer tokens by prompting the user for input and persisting the value to a local configuration file (
config/local.dwl) for use during test execution. This follows established development practices for managing local environment configuration.
Audit Metadata