testing-unit
Fail
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: HIGHDYNAMIC_CONTEXT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context execution pattern (
!command``) across multiple script files to perform automated project introspection at load time.\n - The files
scripts/create-msw-handler.md,scripts/create-test-case.md, andscripts/create-test-fixture.mdall contain shell commands (usinggrep,find, anddate) that execute on the host machine whenever these files are loaded or referenced by the agent.\n- [CREDENTIALS_UNSAFE]: A specific dynamic context command inscripts/create-msw-handler.mdtargets sensitive files:!grep -r "API_URL\|VITE_API\|NEXT_PUBLIC_API" .env*. \n - This pattern programmatically reads through
.envfiles, which are designated sensitive file paths. Since these files are standard locations for storing API keys, authentication tokens, and other secrets, this automated harvesting of data from them poses a high risk of exposing credentials to the agent context.
Recommendations
- AI detected serious security threats
Audit Metadata