test-reviewer
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute local Python scripts (
trace_lint.pyandtrace_build_rtm.py) usingpython3. These scripts are located in a directory defined by the$TESTANY_ENG_ROOTenvironment variable and appear to be part of the testany-io vendor toolkit. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external, potentially untrusted documents including Test Specifications, PRDs, and API Contracts.
- Ingestion points: Processes file content from paths provided by the user in the skill invocation (e.g.,
./docs/Test-Spec.md). - Boundary markers: The skill does not explicitly define specific delimiters or instructions to ignore embedded commands within the analyzed documents.
- Capability inventory: The agent has the capability to execute Python scripts and read files from the project structure.
- Sanitization: The skill relies on script-based validation (
trace-lint) to identify structural issues in the input files.
Audit Metadata