wjttc-builder
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project content which presents a vulnerability surface. \n
- Ingestion points: Reads sensitive project metadata and source files including
package.json, entry points, and API routes. \n - Boundary markers: Absent; the skill does not define delimiters to separate analyzed content from its own instructions. \n
- Capability inventory: The skill is capable of reading project files and writing both markdown plans and executable scripts (.js, .py, .sh). \n
- Sanitization: No sanitization or filtering logic is specified for the data ingested from the codebase before it is used to scaffold new files.\n- [DYNAMIC_EXECUTION]: The skill is designed to generate and scaffold executable test files for multiple environments (Jest/Vitest, pytest, and Shell). Generating executable code based on the analysis of potentially untrusted project data constitutes a dynamic execution risk.
Audit Metadata