test-run-summary-author
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external test artifacts such as JUnit XML and Allure JSON files which could contain malicious instructions designed to influence the agent's summary generation.\n
- Ingestion points: Artifact files located in the
reports/and Allure results directories (e.g.,reports/junit-v4.1.0.xml).\n - Boundary markers: The skill instructions emphasize numeric computation and mandatory source citation ('Audit' tables), which act as delimiters and verification steps.\n
- Capability inventory: The skill produces markdown narratives. The associated evaluation tasks indicate the agent generates and executes Node.js scripts via
npm test(e.g.,scripts/qa-summary.js).\n - Sanitization: The instructions do not specify sanitization or escaping of the content read from test artifacts before it is interpolated into summaries.\n- [DYNAMIC_EXECUTION]: The skill follows a 'Build-an-X' workflow which involves generating JavaScript code and running it to perform analysis.\n
- Evidence: Evaluation tasks in the
evals/directory (e.g.,evals/vp-wants-severity-labels-on-the-release-candidate/task.md) explicitly require the agent to create scripts and run them usingnode --test.\n- [EXTERNAL_DOWNLOADS]: The skill references documentation and schema definitions from external domains includingallurereport.org,practitest.com, andistqb.org.\n - Evidence: Links in the 'References' and 'Ingest the run data' sections of
SKILL.md. These are well-known technology and professional services within the software testing industry.
Audit Metadata