unit-test-starter

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands including git rev-parse --show-toplevel, rg --files -g "*.py" | sort, and python -m pytest to perform repository discovery and execute the generated test suite.
  • [COMMAND_EXECUTION]: The instructions mandate sourcing a local script named source_me.sh before running tests, which results in the execution of any commands contained within that file in the active shell environment.
  • [REMOTE_CODE_EXECUTION]: The skill dynamically generates new Python files, specifically tests/test_*.py and tests/conftest.py, and subsequently executes them through the pytest framework.
  • [REMOTE_CODE_EXECUTION]: The generated conftest.py file performs runtime path manipulation by inserting the repository root and test directories into sys.path using os.path.abspath and os.path.dirname.
  • [PROMPT_INJECTION]: The skill reads and analyzes existing Python source code from the repository to inform the creation of unit tests, creating a surface for indirect prompt injection via untrusted code content.
  • Ingestion points: Python source files (.py) discovered via ripgrep.
  • Boundary markers: None provided in the instructions to delimit ingested code from generation logic.
  • Capability inventory: File system write access, shell command execution (git, ripgrep, pytest), and Python environment modification.
  • Sanitization: The skill does not specify sanitization or escaping mechanisms for the repository content it processes.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 04:44 PM