generating-test-cases
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for potentially untrusted data from git repositories and external documentation. * Ingestion points: The agent is instructed in SKILL.md Step 1 to read content from git diff, git log, git blame, and project documentation files. * Boundary markers: The skill instructions do not define specific delimiters or boundary markers for the ingested data. * Capability inventory: The skill utilizes shell command execution (git) and file system writes (generating .xlsx files via Python). * Sanitization: The skill performs encoding validation as noted in Step 8 but does not explicitly detail sanitization for prompt interpolation.
- [COMMAND_EXECUTION]: The skill uses local git commands to analyze the codebase for changes and regressions. * Evidence: Step 1 of SKILL.md specifies the use of 'git diff', 'git log', and 'git blame'.
- [EXTERNAL_DOWNLOADS]: The skill requires a common third-party Python library for its rendering functionality. * Evidence: 'scripts/render_xlsx.py' includes a comment referencing the dependency on 'openpyxl' via pip install.
Audit Metadata