qa-dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a deployment configuration (
docker-compose.yml) from the official ReportPortal GitHub repository. ReportPortal is a well-known automated testing platform, and the reference is documented neutrally. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it processes untrusted test result data that could be influenced by external contributors or malicious code under test.
- Ingestion points: Test execution data including JUnit XML, coverage JSON, and timing JSON are parsed by the
push-test-metrics.tsscript and Allure report generators. - Boundary markers: The skill does not implement delimiters or specific warnings to ignore instructions embedded within the ingested test data.
- Capability inventory: The skill includes network communication with InfluxDB and ReportPortal, as well as shell command execution through
npxanddocker compose. - Sanitization: There is no evidence of sanitization or schema validation for the contents of the result files before processing.
- [COMMAND_EXECUTION]: The instructions include various commands for report generation (
allure generate), serving data (allure serve), and managing container environments (docker compose up). These are standard for the skill's intended purpose.
Audit Metadata