check-test-code-quality
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [DYNAMIC_EXECUTION]: The orchestrator defined in 'SKILL.md' requires the AI agent to dynamically generate Python scanning code for 22 rules based on markdown descriptions and then execute that code at runtime. This dynamic creation of executable logic based on the structure of scanned files is a significant security risk.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and scan untrusted user-provided source code files (.ets, .ts, .js, .gn). Since the skill uses high-privilege tools like 'Bash', 'Write', and 'Edit' to perform its tasks, there is a risk that specially crafted source files could exploit the agent's regex or state-machine logic to trigger unauthorized file modifications or command execution.
- [COMMAND_EXECUTION]: The tool uses 'Bash' to execute various programs, including 'python' for the R004 scanner, 'openssl' for certificate inspection, and a pre-compiled 'java' JAR file ('hap-sign-tool.jar') for signature repair.
- [EXTERNAL_DOWNLOADS]: Rule 'R010' involves downloading JSON mapping data from 'gitee.com/openharmony' at runtime. While these represent official project repositories, they introduce an external runtime dependency.
- [CREDENTIALS_UNSAFE]: The fix guides and 'signatureP7b.bat' file contain the hardcoded password '123456' for the included 'OpenHarmony.p12' test keystore. While intended for a public test certificate, it is a hardcoded credential.
Audit Metadata