allure-reports
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references standard package managers to install Allure adapters and CLI tools, including PyPI (allure-pytest), NPM (allure-commandline, allure-jest, allure-mocha), and NuGet. It also mentions a third-party GitHub Action (simple-elf/allure-report-action) for CI integration.
- [COMMAND_EXECUTION]: Includes shell commands for generating reports, cleaning directories, and managing test history within CI/CD workflows, primarily using the allure-commandline tool.
- [INDIRECT_PROMPT_INJECTION]: The skill processes test results from the allure-results/ directory, which constitutes an attack surface for indirect prompt injection if the resulting report data is subsequently ingested by an AI agent.
- Ingestion points: Test result JSON files (uuid-result.json, uuid-container.json) located in the allure-results/ directory.
- Boundary markers: None specified in the instructions; the skill relies on the Allure framework's handling of structured JSON data.
- Capability inventory: File system operations (mkdir, cp, allure generate) and artifact management in GitHub Actions.
- Sanitization: Not explicitly handled in the skill; relies on the default behavior of the Allure reporting framework.
Audit Metadata