qa-sprint-report-by-testomatio
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: Potential for indirect prompt injection. The skill ingests data from external Testomat.io project entities (test titles, suite names) which are considered untrusted input and could theoretically contain malicious payloads.
- Ingestion points: Data is retrieved from Testomat.io via
tests_list,runs_get, andtestruns_listas described in SKILL.md. - Boundary markers: The instructions do not define specific delimiters for the interpolated data.
- Capability inventory: The agent performs file write operations to generate .html and .md reports.
- Sanitization: No explicit sanitization or escaping of the retrieved TMS data is mentioned before it is rendered into the final report files.
- [EXTERNAL_DOWNLOADS]: The generated HTML reports are configured to load styling resources from well-known services.
- Evidence: The skill specifies the use of Inter via Google Fonts and Font Awesome 6.4.0 for iconography in the 'HTML Template Styling' section of SKILL.md.
Audit Metadata