qa-write-test-cases
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external and potentially untrusted sources to generate test documentation, creating a surface for indirect prompt injection.\n- Ingestion points: Task trackers (Jira), documentation (Confluence), design tools (Figma), and project source code (SKILL.md, Step 1).\n- Boundary markers: The skill implements manual approval gates for the user to review gathered context and generated checklists, though it does not define technical delimiters for the external content itself.\n- Capability inventory: The skill has the capability to write new markdown files (*.test.md) to the local filesystem (SKILL.md, Step 5).\n- Sanitization: No automated sanitization or escaping of the ingested text is explicitly detailed in the workflow.\n- [SAFE]: The skill is intended for QA professional use and is associated with the 'testomatio' vendor. It uses official MCP tools and follows conventions for Testomat.io integration. It explicitly avoids modifying existing source code and recommends storing generated files in a git-ignored directory.
Audit Metadata