automate-e2e-tests
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, which creates a potential vector for indirect prompt injection attacks.
- Ingestion points: The skill instructs the agent to read requirements, tickets, implementation diffs, and feature validation reports (SKILL.md, Inputs section).
- Boundary markers: There are no defined boundary markers or instructions for the agent to disregard instructions that might be embedded within the external data sources.
- Capability inventory: The skill has access to several shell-based capabilities, including filesystem search tools (
rg,find) and various package managers/test runners (npx,npm,pnpm,yarn,gradlew,xcodebuild,maestro). - Sanitization: The instructions lack specific requirements for sanitizing or escaping the content of tickets or reports before using them to generate test code or shell commands.
- [COMMAND_EXECUTION]: The skill routinely uses shell commands to discover the project structure and execute tests.
- Evidence: Commands such as
rg --files,find . -maxdepth 4, and various test execution commands (e.g.,npx playwright test,./gradlew connectedAndroidTest) are explicitly recommended for the agent to use. - [DYNAMIC_EXECUTION]: The core function of the skill involves the agent writing or modifying test scripts and then executing those scripts in the local environment.
- Evidence: The 'Authoring Flow' instructs the agent to create or update spec files, which are then immediately executed using the commands listed in the 'Validation' section.
Audit Metadata