mutation-testing
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze mutation testing results from various tools (JSON, CSV, or plain text logs) and read source code/test files. This represents an ingestion surface for untrusted data. However, the instructions focus on objective analysis and reporting rather than automatic execution based on this data. The risk is considered inherent to the skill's purpose as a security analysis tool.
- [DYNAMIC_EXECUTION]: The workflow for bug hunting (
workflows/bug-hunter.md) involves writing and running proof-of-concept (PoC) tests to confirm vulnerabilities. This involves generating test code and executing it via the shell. This is a standard and necessary function for a security auditing skill and is performed within the user's project environment. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to interact with mutation testing utilities (mewt,muton) and the project's native test suites (e.g.,cargo test,forge test,npm test). These operations are explicitly defined, limited to the project scope, and essential for the skill's primary function.
Audit Metadata