mutation-testing
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing third-party testing tools from non-trusted external sources, including 'mutmut' via pip, 'Stryker' via npm, and 'gremlins' via go install from github.com/go-gremlins/gremlins.
- [COMMAND_EXECUTION]: The skill executes shell commands to run mutation tests and install dependencies. The custom 'scripts/go-mutation.go' script performs direct in-place modification of source files and executes 'go test' based on paths identified during directory traversal.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local files and tool outputs which could contain malicious instructions. 1. Ingestion points: Reading file markers (e.g., go.mod, package.json) and mutation tool results. 2. Boundary markers: None present. 3. Capability inventory: File system writes and shell command execution. 4. Sanitization: None mentioned for external data ingestion.
Audit Metadata