test-case-writing

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a set of internal Python wrappers (e.g., scripts/parse_pdf.py, scripts/convert_to_json.py) that invoke subprocess.call to run core processing logic in scripts/parse_formats.py and scripts/convert_formats.py. Additionally, scripts/parse_formats.py may execute the system utility pdftotext if available.
  • [DYNAMIC_EXECUTION]: The scripts/parse_formats.py file uses __import__ to dynamically load optional PDF parsing modules (pypdf or PyPDF2) based on the environment's availability.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests untrusted data from various file formats (Excel, CSV, Word, PDF, XMind) processed via the scripts/ directory.
  • Ingestion points: Data is loaded from external files via scripts/parse_formats.py and interpolated into the agent's context.
  • Boundary markers: The SKILL.md and prompts/test-case-writing.md files provide instructions to explicitly mark assumptions and gaps, which serves as a logical boundary for incomplete or conflicting requirements.
  • Capability inventory: The skill can read local files and execute local Python scripts for format conversion.
  • Sanitization: The skill instructions recommend using sanitized data for production-related tasks in the quick-start.md guide.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 06:52 AM