qa-dashboard

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches a deployment configuration (docker-compose.yml) from the official ReportPortal GitHub repository. ReportPortal is a well-known automated testing platform, and the reference is documented neutrally.
  • [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it processes untrusted test result data that could be influenced by external contributors or malicious code under test.
  • Ingestion points: Test execution data including JUnit XML, coverage JSON, and timing JSON are parsed by the push-test-metrics.ts script and Allure report generators.
  • Boundary markers: The skill does not implement delimiters or specific warnings to ignore instructions embedded within the ingested test data.
  • Capability inventory: The skill includes network communication with InfluxDB and ReportPortal, as well as shell command execution through npx and docker compose.
  • Sanitization: There is no evidence of sanitization or schema validation for the contents of the result files before processing.
  • [COMMAND_EXECUTION]: The instructions include various commands for report generation (allure generate), serving data (allure serve), and managing container environments (docker compose up). These are standard for the skill's intended purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 09:22 AM