qa-test-mutate
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill extracts code snippets from the target project's source and test files to document surviving mutants. These snippets are saved to a JSON artifact and then passed to a sub-agent via the Task tool to generate targeted tests. An attacker who can influence the project's code could potentially embed instructions within these snippets to manipulate the behavior of the sub-agent.
- Ingestion points: The skill reads source code, test files (e.g., **/.test.ts, **/test_.py), and tool output logs (e.g., mutation.json, infection-log.json) in SKILL.md Steps 2 and 4.2.
- Boundary markers: The survivors JSON schema for the handoff contract does not define boundary markers or 'ignore' instructions for the included code snippets.
- Capability inventory: The skill utilizes the Bash tool for command execution, Task tool for sub-agent delegation, and Write/Edit tools for file system modifications.
- Sanitization: The instructions do not mention sanitization or escaping of 'original' and 'mutated' code snippets extracted from external files.
- [COMMAND_EXECUTION]: The skill executes various mutation frameworks and test runners (StrykerJS, Infection, go-mutesting, mutmut, vitest) using the Bash tool. While it safely uses the --no-install flag for Node.js commands, it executes binaries from the project's local vendor directory (e.g., vendor/bin/infection) and the system path. Executing code from an untrusted project environment is a standard risk for development-focused AI agents.
Audit Metadata