qc-code
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted source code to generate reviews and test cases.
- Ingestion points: SKILL.md describes reading code via
git diffor user-provided file paths. - Boundary markers: Absent. The skill does not define specific delimiters for the untrusted code content.
- Capability inventory: The skill has the ability to read files, write new test files to the project directory, and execute shell commands to run those tests.
- Sanitization: No sanitization of the processed code is mentioned before it is used to influence the agent's output and test generation.
- [DYNAMIC_EXECUTION]: The skill generates and runs test scripts based on the results of the code review.
- Evidence: Instructions to write
qc-*test files to the project and executepython3 harness/scripts/qc-regression.py --run. - [COMMAND_EXECUTION]: The skill relies on local shell commands for version control analysis and test execution.
- Evidence: Use of
git difffor scope determination andpython3for running regression and grounding scripts.
Audit Metadata