agentic-qa-core
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents workflows that ingest and process untrusted data from external sources like Jira (e.g., acceptance criteria and bug reports) to drive automated test generation and reporting.
- Ingestion points: Jira issue content is synchronized to local markdown files via
bun run jira:sync-issuesfor agent consumption. - Boundary markers: The
references/skill-resolver.mdprotocol defines how to inject compact, authoritative rules into subagent briefings to limit the influence of untrusted data. - Capability inventory: The skill employs
curl,acli, and variousbunscripts for both read and write operations on the filesystem and external APIs. - Sanitization:
references/jira-publishing-gotchas.mddetails the conversion process from Markdown to Atlassian Document Format (ADF) for secure data publishing. - [COMMAND_EXECUTION]: The skill instructs the agent to execute various CLI tools and scripts to perform environment validation, API testing, and Jira synchronization.
references/api-testing-doctrine.mdspecifies authenticated API execution usingcurlwith sourced environment variables.references/preflight-gate.mddetails the use ofbun runcommands for manifest checks and capability probing.- [EXTERNAL_DOWNLOADS]: The skill references the download and setup of development dependencies and testing tools from recognized providers.
references/preflight-gate.mdmentionsbun run pw:installfor Playwright browser binaries andgentle-ai installfor framework components.
Audit Metadata