test-reporting-triage-skill
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from test error messages and stack traces to generate automated reports.
- Ingestion points: The
recordFailuremethod inSKILL.mdaccepts anErrorobject whose message and stack properties are used to populate reports. - Boundary markers: The
generateReportfunction uses markdown code blocks (triple backticks) to encapsulate error messages, providing a structural delimiter to help prevent instructions in error messages from being executed by downstream viewers. - Capability inventory: The skill is designed to work with a CI workflow defined in
.github/workflows/test-report.ymlthat has permissions to create GitHub issues and send messages to Slack via the Slack API. - Sanitization: There is no explicit sanitization or filtering of the error message content before it is included in the output report.
- [EXTERNAL_DOWNLOADS]: The CI integration configuration references standard, well-known GitHub Actions for workflow automation.
- Evidence:
SKILL.mdincludes references to official GitHub actions includingactions/checkout,actions/download-artifact,slackapi/slack-github-action, andactions/github-script.
Audit Metadata