Testing

Pass

Audited by Gen Agent Trust Hub on Mar 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill is designed to execute system commands such as pytest, npx jest, mvn test, go test, and cargo test to run test suites. While these are standard development tools, executing them on agent-generated or untrusted code requires caution to ensure the commands are not manipulated.
  • [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it reads and processes untrusted data from source files and existing test scripts. Maliciously crafted comments or documentation in these files could potentially influence the agent's behavior during test generation.
  • Ingestion points: Processes source files, directories, and existing test files as described in the Usage section.
  • Boundary markers: No specific delimiters or warnings to ignore embedded instructions are defined for the ingested code.
  • Capability inventory: The skill can execute shell commands (pytest, jest, mvn, go, cargo) to run generated tests.
  • Sanitization: No explicit sanitization or validation of the input source code is mentioned before processing.
  • [EXTERNAL_DOWNLOADS]: The use of npx jest and npx vitest involves the Node Package Executor, which may automatically download and run packages from the npm registry if they are not already present in the local environment. This is a standard behavior for these tools but represents a point of external dependency.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 19, 2026, 01:41 AM