test-case-writing
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a set of internal Python wrappers (e.g.,
scripts/parse_pdf.py,scripts/convert_to_json.py) that invokesubprocess.callto run core processing logic inscripts/parse_formats.pyandscripts/convert_formats.py. Additionally,scripts/parse_formats.pymay execute the system utilitypdftotextif available. - [DYNAMIC_EXECUTION]: The
scripts/parse_formats.pyfile uses__import__to dynamically load optional PDF parsing modules (pypdforPyPDF2) based on the environment's availability. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests untrusted data from various file formats (Excel, CSV, Word, PDF, XMind) processed via the
scripts/directory. - Ingestion points: Data is loaded from external files via
scripts/parse_formats.pyand interpolated into the agent's context. - Boundary markers: The
SKILL.mdandprompts/test-case-writing.mdfiles provide instructions to explicitly mark assumptions and gaps, which serves as a logical boundary for incomplete or conflicting requirements. - Capability inventory: The skill can read local files and execute local Python scripts for format conversion.
- Sanitization: The skill instructions recommend using sanitized data for production-related tasks in the
quick-start.mdguide.
Audit Metadata