testing-patterns

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/test_runner.py executes system commands to run tests using subprocess.run. It invokes standard tools like npm, npx, or python based on the project's configuration files. This behavior is the primary intended function of the script and uses list-based arguments to prevent shell injection.\n- [INDIRECT_PROMPT_INJECTION]: The test runner reads external metadata from files like package.json to identify the appropriate test framework. \n
  • Ingestion points: package.json, pyproject.toml, and requirements.txt in scripts/test_runner.py.\n
  • Boundary markers: Absent.\n
  • Capability inventory: Shell command execution via subprocess.run.\n
  • Sanitization: The script maps detected dependencies to hardcoded command lists (e.g., [\"npm\", \"test\"]), preventing the direct execution of untrusted strings from project files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 02:33 PM