prd-auto-test-loop
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted PRD (Product Requirements Document) files to determine test scope and requirements.
- Ingestion points: PRD files identified in Workflow Step 1 and templates in
references/自动化测试封装指南.md. - Boundary markers: Absent. There are no delimiters or instructions to ignore embedded commands within the ingested PRD data.
- Capability inventory: The skill has capabilities to create directories (
mkdir) and write files (cat) via shell commands. - Sanitization: No evidence of sanitization or validation of the content extracted from PRDs before it is used to influence agent actions or file content.
- [COMMAND_EXECUTION]: The skill executes shell commands using variables that may be derived from external data, presenting a potential path traversal or command injection risk.
- Evidence: In
SKILL.mdand_archive/scaffold_prd_test_pack.sh, the skill uses variables such as$versionand$project_rootto construct file paths formkdirandcatoperations. If a malicious PRD provides a version string containing path traversal characters (e.g.,../../), the agent could be manipulated into creating files or directories outside the intended project structure.
Audit Metadata