Skills
Navigate
skills/testland/qa/tcm-case-management/Gen Agent Trust Hub

tcm-case-management

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external CSV files to perform bulk imports into various test case management platforms. This creates an attack surface where malicious instructions embedded in the source data could potentially influence agent behavior.
  • Ingestion points: Detected in SKILL.md, references/qase-io.md, and references/zephyr-scale.md where csv.DictReader is used to parse external files.
  • Boundary markers: The skill does not provide explicit instructions or delimiters to isolate the external data from the agent's logic.
  • Capability inventory: The skill has network capabilities via the requests library to communicate with external APIs across all documented platforms.
  • Sanitization: No input validation or sanitization is implemented for the data read from the external CSV files before it is processed.
  • [EXTERNAL_DOWNLOADS]: The skill documentation references the installation and use of official integration tools.
  • The documentation recommends the use of well-known, official packages such as allurectl and the qase-python SDK from recognized vendors for CI/CD integration.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 10:13 AM