ai-test-generation
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external, potentially untrusted data such as PRDs, user stories, and bug reports to generate executable test code.
- Ingestion points: Processes external inputs in Step 1 (Requirements Extraction) to drive the pipeline.
- Boundary markers: Step 1 distinguishes between explicit and implicit requirements; Step 7 mandates human review of all generated outputs.
- Capability inventory: Generates test code for various frameworks and utilizes verification tools including
tsc,pyflakes, andgrepfor static analysis. - Sanitization: Implements a mechanical verification gate (Verification section) that uses linters and type-checkers to catch hallucinated APIs before the code is executed.
- [COMMAND_EXECUTION]: Recommends the execution of various CLI tools for project initialization and code verification.
- Evidence: Commands include
npx playwright init-agents,npx tsc --noEmit,python -m pyflakes, andruff check. - Evidence: Provides a shell script snippet using
grepandsedto validate that generated test selectors exist within the target codebase. - [EXTERNAL_DOWNLOADS]: Mentions downloading official tools from well-known services.
- Evidence: References
npx @playwright/mcp@latestto fetch the Playwright MCP server.
Audit Metadata