daily-testing-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill's components align with its stated purpose of managing a QA testing workflow.
- [COMMAND_EXECUTION]: Multiple Python scripts utilize subprocess.call() to execute internal formatting tools. These implementations use list-based arguments rather than shell strings, which is a recommended security practice to prevent command injection.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted project context, which is an intended ingestion point. Ingestion points: User-provided context about goals, build status, and constraints via prompts. Boundary markers: SKILL.md explicitly instructs the agent to separate facts from assumptions and mark gaps. Capability inventory: The skill includes local scripts for parsing and converting file formats such as JSON, CSV, Word, and Excel. Sanitization: The workflow relies on manual logical checks and marking assumptions rather than programmatic data filtering.
Audit Metadata