pr-test-impact-analysis
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data including pull request descriptions, code diffs, and CI results as part of its primary function (
SKILL.md,prompts/pr-test-impact-analysis.md). This creates a surface for indirect prompt injection attacks. - Ingestion points: Untrusted data enters the agent context through pull request descriptions, code diffs, test mappings, and dependency graphs provided by the user or the environment.
- Boundary markers: The skill includes robust instructional boundaries, directing the agent to 'Audit input', 'separate confirmed facts, working assumptions, and open questions', and use specific labels like 'Hypothesis to Verify' for unsupported claims.
- Capability inventory: Analysis shows the skill lacks dangerous capabilities such as direct file writing, network exfiltration tools, or arbitrary command execution in its core instructions.
- Sanitization: The skill implements logical validation and evidence-linking requirements to mitigate the impact of potentially malicious instructions embedded in the diff or description content.
- [SAFE]: The evaluation framework provided with the skill (
evals/fixtures/check-domain-decisions.sh,evals/fixtures/check_domain_decisions.py) consists of standard shell and Python scripts used for deterministic validation of generated analysis tables. These scripts do not perform network operations, access sensitive system paths, or execute code dynamically from external sources. They are restricted to parsing the agent's output message and comparing it against a predefined oracle.
Audit Metadata