skills/wallabyjs/skills/wallaby-cli/Gen Agent Trust Hub

wallaby-cli

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the @wallabyjs/cli package from the npm registry and fetches updates from the vendor's official domain (wallabyjs.com). These resources originate from the skill's author and established package registries.\n- [COMMAND_EXECUTION]: The skill executes the wallaby-skill binary through various package managers (npx, pnpm, yarn, bun) to perform testing and analysis tasks requested by the agent.\n- [INDIRECT_PROMPT_INJECTION]: The skill presents potentially untrusted data from test outputs and source code to the agent.\n
  • Ingestion points: Test result summaries (all-tests.md), failure diagnostics (failing-tests.md), global system logs (global-logs.md), and runtime inspection values (runtime-values.md).\n
  • Boundary markers: The skill formats these reports using Markdown headers (e.g., ## File:, ### Test name) and fenced code blocks to distinguish data from instructions.\n
  • Capability inventory: Access to the wallaby-skill CLI for project-wide testing, file analysis, and runtime state inspection.\n
  • Sanitization: The skill does not explicitly sanitize the content of test logs or source fragments before they are written to reports for agent consumption, relying instead on Markdown structure and search tools like grep for navigation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 05:02 AM