z-go-bdd
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous shell commands for executing BDD suites, including complex
go testcommands with parallel execution, label filters, and timeout settings. - [EXTERNAL_DOWNLOADS]: Documentation in
references/godog-suite.mdprovides instructions to install thegherkingenutility from a GitHub repository usinggo install github.com/hedhyw/gherkingen/v4/cmd/gherkingen@v4.1.1. - [DYNAMIC_EXECUTION]: The skill workflow involves using
gherkingento generate Go source code stubs from Gherkin feature files, which are then used as the basis for test implementation. - [INDIRECT_PROMPT_INJECTION]: The skill explicitly instructs the agent to use
.featurefiles as compact domain context to guide its behavior and code generation logic. - Ingestion points: Content from
.featurefiles is loaded into the agent's context as described inreferences/llm-feature-context.md. - Boundary markers: No specific delimiters or safety instructions are defined to separate feature file content from agent instructions during interpolation.
- Capability inventory: The agent is empowered to install tools, generate executable code, and run shell commands, all of which could be manipulated by adversarial content in a feature file.
- Sanitization: The instructions do not require sanitization or validation of the Gherkin text before it is used for RAG (Retrieval-Augmented Generation) or code generation.
Audit Metadata