testing-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/test_runner.pyexecutes system commands to run tests usingsubprocess.run. It invokes standard tools likenpm,npx, orpythonbased on the project's configuration files. This behavior is the primary intended function of the script and uses list-based arguments to prevent shell injection.\n- [INDIRECT_PROMPT_INJECTION]: The test runner reads external metadata from files likepackage.jsonto identify the appropriate test framework. \n - Ingestion points:
package.json,pyproject.toml, andrequirements.txtinscripts/test_runner.py.\n - Boundary markers: Absent.\n
- Capability inventory: Shell command execution via
subprocess.run.\n - Sanitization: The script maps detected dependencies to hardcoded command lists (e.g.,
[\"npm\", \"test\"]), preventing the direct execution of untrusted strings from project files.
Audit Metadata