testing-unit

Fail

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: HIGHDYNAMIC_CONTEXT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context execution pattern (!command``) across multiple script files to perform automated project introspection at load time.\n
  • The files scripts/create-msw-handler.md, scripts/create-test-case.md, and scripts/create-test-fixture.md all contain shell commands (using grep, find, and date) that execute on the host machine whenever these files are loaded or referenced by the agent.\n- [CREDENTIALS_UNSAFE]: A specific dynamic context command in scripts/create-msw-handler.md targets sensitive files: !grep -r "API_URL\|VITE_API\|NEXT_PUBLIC_API" .env*. \n
  • This pattern programmatically reads through .env files, which are designated sensitive file paths. Since these files are standard locations for storing API keys, authentication tokens, and other secrets, this automated harvesting of data from them poses a high risk of exposing credentials to the agent context.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 12, 2026, 01:32 AM