tc-run
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external
.xlsxfiles (Test Case ID/Description/Steps/Expected) usingharness/scripts/tc-xlsx.py. This data directly influences the agent's behavior during browser automation. There are no explicit boundary markers or sanitization procedures defined to prevent the agent from following instructions embedded within the test case content itself. - [COMMAND_EXECUTION]: The skill relies on executing local shell commands and Python scripts (
harness/scripts/tc-xlsx.pyandharness/scripts/orca-graph.py) to extract data, classify tests, and manage the execution flow. - [DYNAMIC_EXECUTION]: The skill generates a plan (
PLAN.md) based on the content of the parsed Excel file and subsequently executes this plan viaorca-graph.py. This runtime generation and execution of a task graph based on external input represents a dynamic execution pattern.
Audit Metadata