qt-qml-test-run
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes standard development tools such as cmake, qmltestrunner, and git to facilitate the testing workflow. These operations are scoped to the project environment and are essential for its stated purpose.
- [DYNAMIC_EXECUTION]: During the optional wire-up process, the skill generates boilerplate C++ and CMake files (tests/CMakeLists.txt and tests/main.cpp). These files are subsequently compiled into a test executable, which is the intended behavior for establishing a persistent test infrastructure and is handled with user oversight.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from project files (tst_*.qml) and test runner output (processed via references/scripts/parse-qmltestrunner-output.py). The agent has shell execution capabilities (cmake, qmltestrunner, and git). Mitigation is provided via robust guardrail instructions in SKILL.md that direct the agent to treat all processed content strictly as technical material, preventing the execution of instructions that might be embedded within comments or strings in the project files.
- [EXTERNAL_DOWNLOADS]: The documentation points to the author's official GitHub repository for installation instructions. These references represent standard distribution methods for the vendor's tools and are documented neutrally.
Audit Metadata