quality-metrics
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is focused on quality engineering methodologies and does not contain any malicious code, obfuscation, or unauthorized data access patterns. All identified components, including the output schemas and evaluation test suites, are consistent with the stated purpose of tracking engineering KPIs.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data such as deployment logs, incident reports, and test results to calculate metrics. While this represents a potential surface for indirect prompt injection—where malformed or malicious data in a build log could theoretically attempt to influence the agent's summary—the skill utilizes structured orchestration through specific agent roles (e.g.,
qe-quality-analyzer) and predefined tasks, which significantly mitigates this risk. No specific evidence of vulnerable interpolation without sanitization was found. - [COMMAND_EXECUTION]: The evaluation suite (
evals/quality-metrics.yaml) and validation configuration (scripts/validate-config.json) list standard development tools such asjq,ajv, andpython3as requirements. These are used for validating JSON outputs and performing local calculations within a controlled testing environment, representing standard DevOps practices rather than arbitrary command execution risks.
Audit Metadata