sc-test
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads project source modules and configuration files to identify testing requirements and patterns. This creates a surface where malicious instructions embedded in the code being analyzed could influence the agent's behavior during the test generation or execution phases.
- Ingestion points: Source modules, test infrastructure files (e.g.,
conftest.py,jest.config.*), and existing test examples read during Phases 2.1 and 3.1. - Boundary markers: The instructions do not define specific delimiters or warnings to ignore instructions found within the processed code files.
- Capability inventory: The skill possesses the ability to execute shell commands, write new files to the system, and perform network operations via Rube MCP.
- Sanitization: There is no mention of sanitization or validation logic for the data ingested from the file system.
- [DYNAMIC_EXECUTION]: The skill dynamically constructs and executes new test scripts (Python, TypeScript, Go) using the AAA (Arrange/Act/Assert) pattern to improve code coverage.
- Evidence: Phase 3 outlines the process for writing new unit, integration, and E2E tests, which are subsequently executed in Phase 4 using framework-specific runners.
- [COMMAND_EXECUTION]: The skill utilizes a variety of CLI tools for running tests, checking coverage, and formatting code, including
pytest,jest,go test,cargo tarpaulin,ruff, andeslint. - [EXTERNAL_DOWNLOADS]: The skill employs
npxfor executing JavaScript-based tools, which may involve downloading packages if they are not already installed. It also features a--linkupflag that utilizes Rube MCP to perform web searches for development guidance.
Audit Metadata