create-test-project
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands using the
opentaintCLI andjavap. These commands are used to initialize test environments, inspect dependency method signatures, and compile test models into deliverables. These actions are standard for the skill's intended purpose as a development utility. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted data from external files to generate source code and construct shell parameters.
- Ingestion points: Reads rule requirements from
<spec>, metadata from<tracking-file>, and dependency coordinates frombuild.gradleorpom.xmlfiles. - Boundary markers: The instructions do not specify any boundary markers or delimiters to protect against malicious instructions embedded in the ingested build or specification files.
- Capability inventory: The skill is capable of executing shell commands and performing file writes to create or modify Java source files and project configurations.
- Sanitization: There is no evidence of input validation or sanitization before the ingested data is interpolated into shell commands or generated code samples.
Audit Metadata