test-strategy

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to audit the environment, including listing GitHub Actions runs via gh run list and checking for the existence of overlay directories using ls.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a 'private overlay' feature that dynamically loads and prioritizes instructions from a filesystem path defined by the $POWERSUIT_OVERLAY environment variable.
  • Ingestion points: Repository test files, CI logs, and instruction files located within the $POWERSUIT_OVERLAY/sdlc/ directory (specifically README.md and files in sdlc/test-strategy/).
  • Boundary markers: No specific delimiters or safety wrappers are defined for the content ingested from the overlay path or repository files.
  • Capability inventory: The skill possesses the ability to read and write files (e.g., docs/sdlc.md, PR templates), execute shell commands (gh, ls), and modify CI/CD workflow configurations.
  • Sanitization: There is no evidence of sanitization or validation performed on the instructions loaded from the external overlay path.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 12:50 PM