run-tests-with-testomatio-reporter
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use
npx @testomatio/reporter, which fetches and executes the reporter package from the NPM registry. This is a vendor-owned package utilized for its primary purpose of test management. - [COMMAND_EXECUTION]: The skill utilizes a command wrapper (
run "<runner command>") that executes arbitrary shell commands provided as the runner. This is the intended functionality of the CLI tool to capture and report test outputs from various frameworks. - [CREDENTIALS_UNSAFE]: The skill requires several sensitive environment variables for operation, such as the
TESTOMATIOAPI key and platform access tokens (GH_PAT,GITLAB_PAT,BITBUCKET_ACCESS_TOKEN). These are handled as environment variables rather than being hardcoded, which follows standard security practices for CI/CD integrations. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The reporter reads local YAML files (coverage maps) and processes output from
git diffcommands to determine the scope of tests. - Boundary markers: None identified in the provided command instructions.
- Capability inventory: The skill has the capability to execute shell commands (runners) and perform network operations to report results to Testomat.io and platform APIs (GitHub/GitLab/Bitbucket).
- Sanitization: No explicit sanitization or validation of the YAML coverage map content or the runner command string is described in the skill instructions.
Audit Metadata