testing-integration

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The skill uses the ! dynamic command syntax in the scripts/create-integration-test.md file to perform local project introspection. These commands use shell tools like grep and find to detect the presence of test databases in .env files, identify existing integration tests, and determine the installed test framework and API clients. These operations are read-only, targeted to specific configuration patterns, and do not involve network exfiltration or the execution of untrusted external input.
  • [INDIRECT_PROMPT_INJECTION]: The template in scripts/create-integration-test.md uses a $ARGUMENTS placeholder to allow users to specify test names. This input is interpolated into generated file paths and Python code blocks. While this provides an interface for external data to influence the agent's output, it is used within the intended scope of generating scaffolding for developer tests and does not bypass safety constraints or execute untrusted commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 05:22 AM
Security Audit — agent-trust-hub — testing-integration