mcore-testing
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes a script,
download_golden_values.py, to fetch baseline validation data from GitHub. Additionally, the test configuration inconftest.pyis designed to automatically download missing test data if it is not present in the local environment. - [COMMAND_EXECUTION]: The documentation provides multiple shell command templates for executing distributed tests. These commands use
uv,pytest, andtorch.distributed.runto launch workloads, which is the intended behavior for reproducing CI/CD test failures and local development. - [PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it processes external YAML recipes and JSON golden values that influence the execution flow and validation criteria of the tests.
- Ingestion points: The agent reads configuration from
tests/test_utils/recipes/and data fromtests/functional_tests/test_cases/. - Boundary markers: No explicit boundary markers or "ignore instructions" warnings are documented for the processed data.
- Capability inventory: The skill is capable of executing shell scripts via
bashand running Python modules throughtorch.distributed.run. - Sanitization: Analysis of the instructions does not show explicit sanitization or validation of the content within the YAML/JSON files beyond standard parsing.
Audit Metadata