xray-cli

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes test-related data (e.g., test summaries, manual steps, Gherkin features, and test definitions) from external Xray and Jira environments.
  • Ingestion points: Data is retrieved through commands like bun xray test get, bun xray run list, and bun xray backup export, as well as during the enrichment of local PBI cache files.
  • Boundary markers: The instructions do not specify explicit delimiters or warnings to ignore instructions embedded within the processed external test data.
  • Capability inventory: The skill utilizes the Bash tool to execute a wide range of bun xray commands, including test creation, run status updates, and full project backup and restore operations.
  • Sanitization: No specific sanitization or filtering logic is described for the external content before it enters the agent's context.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with external API endpoints to perform its core functions, such as authentication and data synchronization.
  • Evidence: Communicates with xray.cloud.getxray.app for authentication and GraphQL queries, and *.atlassian.net for Jira REST API operations.
  • [COMMAND_EXECUTION]: The skill relies on the execution of the bun xray CLI tool to perform its stated test management operations.
  • Evidence: The skill is configured to allow the Bash tool to run commands starting with bun xray:.
  • [DATA_EXFILTRATION]: The skill manages sensitive authentication credentials required to interact with the target services.
  • Evidence: Credentials such as Xray API keys and Atlassian tokens are read from .env files and stored in ~/.xray-cli/config.json. These credentials are used for authenticating requests to the official Xray and Atlassian domains.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 08:14 PM
Security Audit — agent-trust-hub — xray-cli