om-smart-test
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository, such as file names, git diffs, and project manifests, which could be manipulated to include malicious instructions.
- Ingestion points: Git diff output, workspace manifests (e.g., package.json, Cargo.toml), and the test map file (
.ai/test-map.json) are read to determine affected units and test paths. - Boundary markers: The skill contains explicit instructions in
references/agentic-setup.mdto treat repository content as data only, ignore any embedded directives, and report them as suspected prompt injection. - Capability inventory: The skill executes shell commands for testing and environment preparation using subprocesses.
- Sanitization: All placeholder values interpolated into commands are validated against the regex
^[A-Za-z0-9._/@+-]+$and are single-quoted to prevent command injection. - [COMMAND_EXECUTION]: The skill executes test commands, but restricts them to those defined in committed, operator-vouched configuration files.
- Source of commands: Commands are sourced solely from
.ai/agentic.config.json(undersmartTest.suitesorvalidation.commands). - Restriction: The instructions explicitly forbid inventing commands or executing strings read from the test map, ensuring only pre-approved testing tools are used.
Audit Metadata