qe-test-generation
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data, specifically source code files (e.g.,
src/services/PaymentService.ts) and coverage reports (e.g.,coverage/lcov.info), to generate test suites. This creates a surface where malicious instructions embedded in code comments or data files could influence the agent's output or actions. - Ingestion points: Source code modules and coverage reports provided via the
--fileargument oranalyzeAndGeneratemethod. - Boundary markers: Absent. The instructions do not define delimiters or specific 'ignore' instructions for the content of the analyzed files.
- Capability inventory: The skill generates and writes test files to the local filesystem and interacts with the
aqeCLI tool. - Sanitization: Absent. There are no instructions for the agent to sanitize, escape, or validate the content of the files before processing them for test generation.
Audit Metadata