shift-left-testing
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it is designed to analyze untrusted external content such as user requirements, design documents, and source code changes.
- Ingestion points: The orchestration logic in
SKILL.mdacceptsrequirements(userStories) andchangedFiles(prFiles). The evaluation suite inevals/shift-left-testing.yamlutilizescode_changesanddesigninputs. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat this ingested content as data rather than instructions, which is a common surface for indirect prompt injection.
- Capability inventory: The skill utilizes specialized agents for requirements validation and test generation, and provides configuration examples for executing shell commands (
npm,npx) within a CI/CD environment. - Sanitization: There is no evidence of sanitization or input filtering mentioned in the provided documentation or validation schemas.
Audit Metadata