risk-based-testing
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill defines a clear instructional framework for quality assurance analysis without requesting sensitive permissions, hardcoded credentials, or network access.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface as it processes user-supplied risk descriptions and failure modes. However, it effectively mitigates this risk by enforcing a mandatory 'Input Audit' phase in
prompts/risk-based-testing.md. This requires the agent to explicitly categorize known facts, missing information, and assumptions before proceeding, which serves as a cognitive boundary against malicious instructions embedded in the input data. - [SAFE]: The evaluation suite contains a Python script (
evals/fixtures/check_domain_decisions.py) used for automated output verification. The script performs deterministic string and table parsing against a static oracle and does not utilize dynamic code execution (eval/exec) or perform external network operations.
Audit Metadata