run-testsprite-backend
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@testsprite/testsprite-clipackage from the official NPM registry to provide testing capabilities. This is a well-known tool required for the skill's primary function. - [COMMAND_EXECUTION]: The skill executes the
testspriteCLI tool to interact with the TestSprite platform and runs a local Python script,audit_backend_test.py, to perform static analysis on user-authored test code. These commands are restricted to the testing workflow and include safety measures likeumask 077for file operations. - [INDIRECT_PROMPT_INJECTION]: The skill processes external API response data (e.g.,
apiOutput,trace,result.json) which could potentially contain malicious instructions if the target service is compromised. However, the skill provides extensive guidance on sanitizing this data before consumption, including removing secrets and minimizing personal data. Furthermore, the includedaudit_backend_test.pyscript acts as a defensive layer to reject unsafe dynamic shapes and obvious injection patterns in authored code.
Audit Metadata