mutation-testing

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied mutation reports which creates an indirect prompt injection surface. * Ingestion points: User-pasted mutation output (e.g., 'evil:' blocks) as described in SKILL.md. * Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the reports. * Capability inventory: The agent is authorized to use the Bash tool for command execution and the Write/Edit tools for file system modifications. * Sanitization: No validation or sanitization of the input reports is defined before the agent parses and acts on them.
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute development commands and process output. * Evidence: Execution of 'bundle exec mutant run' and 'bundle exec rspec' for testing workflows. * Evidence: A shell pipeline involving 'sed' and 'sort' is used to generate ignore lists for legacy project setup.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 03:35 PM