unit-testing
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to process user-provided source code to generate, improve, or debug unit tests. This creates an attack surface for indirect prompt injection where malicious instructions could be embedded in the code under test.
- Ingestion points: User-supplied functions, classes, and requirements processed by the agent (facilitated by
SKILL.md). - Boundary markers: Absent; there are no explicit instructions for the agent to ignore embedded commands in the source code it analyzes.
- Capability inventory: The skill provides instructions for executing shell commands including test runners and package managers (
npx vitest,pytest,dotnet test,npm ci,pip install). - Sanitization: No sanitization or validation logic is specified for the input code.
- [EXTERNAL_DOWNLOADS]: The skill references official documentation and provides instructions for using well-known package managers and testing frameworks. These downloads and references target industry-standard registries and official domains (e.g., vitest.dev, jestjs.io, docs.pytest.org, xunit.net) and are considered safe.
Audit Metadata