observability-driven-testing

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill uses production telemetry, such as error logs and traces, as input to automatically design and write new test cases. Because this data originates from the application's runtime environment (which may process user-controlled input), it represents an indirect prompt injection surface.
  • Ingestion points: SKILL.md (Production Error to Test Pipeline section) and references/log-and-error-pipeline.md (via the ProductionError interface).
  • Boundary markers: The skill does not provide specific instructions or delimiters to isolate untrusted error messages from the agent's instructions during the test design phase.
  • Capability inventory: The skill involves writing new test scripts and executing them using playwright test or npx, alongside package management via npm install.
  • Sanitization: The provided utility script analyze-production-errors.ts does not include sanitization or validation of the message or stack fields before they are used to categorize gaps or name tests.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:18 PM