risk-based-testing
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could potentially contain malicious instructions designed to influence agent behavior.
- Ingestion points: The skill ingests
changedFiles,bugDatabase, production incident data, and CI/CD pull request metadata (SKILL.md). - Boundary markers: No explicit instructions or delimiters are defined to ensure the agent ignores or sanitizes instructions that might be embedded within these data sources (e.g., a malicious bug report or a file name).
- Capability inventory: The skill possesses capabilities to execute shell commands in CI/CD pipelines (
aqe risk-analyze,npm run test) and coordinates a fleet of agents including quality gates and test generators (SKILL.md). - Sanitization: There is no evidence of input validation or sanitization mechanisms for the processed data before it is used to influence test selection or agent coordination.
Audit Metadata