vibe-behavioral-test-capture
Warn
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill generates executable TypeScript and Python test files from captured runtime telemetry and network snapshots, then instructs the agent to run these scripts using system package managers or test runners like npm or pytest.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. Evidence: 1. Ingestion points: Network traces, DOM state snapshots, and DISCOVERY_REPORT.md; 2. Boundary markers: Absent; 3. Capability inventory: Bash (test execution) and Write (script creation); 4. Sanitization: Includes credential scrubbing but lacks injection-prevention measures for generated code content.
- [COMMAND_EXECUTION]: Shell commands are triggered to execute generated tests (e.g., npm run test), resulting in a pipeline where external data can potentially influence command-line behavior or parameters.
Audit Metadata