observability-driven-testing
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses production telemetry, such as error logs and traces, as input to automatically design and write new test cases. Because this data originates from the application's runtime environment (which may process user-controlled input), it represents an indirect prompt injection surface.
- Ingestion points:
SKILL.md(Production Error to Test Pipeline section) andreferences/log-and-error-pipeline.md(via theProductionErrorinterface). - Boundary markers: The skill does not provide specific instructions or delimiters to isolate untrusted error messages from the agent's instructions during the test design phase.
- Capability inventory: The skill involves writing new test scripts and executing them using
playwright testornpx, alongside package management vianpm install. - Sanitization: The provided utility script
analyze-production-errors.tsdoes not include sanitization or validation of themessageorstackfields before they are used to categorize gaps or name tests.
Audit Metadata