report-regressions
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data including
scope.json, campaign indices, and progress ledgers to generate reports. - Ingestion points: Reads campaign data files including
scope.json, progress ledgers, and stage packages from the local directory. - Boundary markers: No explicit data delimiters are used, but the instructions require strict adherence to standard definitions and project-specific guidance files (
../../docs/regression-definition.md). - Capability inventory: The skill executes a local script
report.pyand writes output artifacts to the assigned reports directory. - Sanitization: The instructions explicitly forbid the agent from repairing decisions, inventing evidence, or editing hashes to pass validation, which serves as a prompt-level constraint against untrusted data influence.
- [COMMAND_EXECUTION]: The skill invokes a local Python script using the
uvtool. - Evidence:
uv run --no-project ../../scripts/report.py - The script is located within the repository's internal file structure and is used for its intended purpose of rendering reports in HTML, Markdown, and JSON formats.
Audit Metadata