senior-qa
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of local Python scripts (
test_suite_generator.py,coverage_analyzer.py, ande2e_test_scaffolder.py) and standard CLI tools like npm and npx for managing test lifecycles. These are expected behaviors for a developer-oriented QA utility. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process untrusted project source code to generate test fixtures. While this is the core functionality, developers should note the following risk profile:
- Ingestion points: Processes contents of
src/components/andsrc/app/(SKILL.md). - Boundary markers: Absent; there are no specific delimiters or instructions for the agent to ignore potentially malicious embedded instructions in the source code.
- Capability inventory: The skill possesses file-writing capabilities (creating test stubs) and command execution capabilities (running the generated tests via npm/npx).
- Sanitization: No sanitization or validation of the input source code is documented before interpolation into test templates.
Audit Metadata