prd-test-writer

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The generated HTML templates (prd-review.html.tmpl and test-cases-review.html.tmpl) and their sample outputs reference the Mermaid library from https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs. This is a well-known and trusted Content Delivery Network (CDN) service used for rendering diagrams within the documentation.
  • [COMMAND_EXECUTION]: The skill facilitates the creation of executable test cases. The provided samples (test-case-example.md) include shell commands like npm run smoke:provider and npm run e2e:clients. These commands are intended to be executed within the project's local development environment to verify software functionality.
  • [DATA_EXFILTRATION]: While the skill involves reading sensitive project code to establish "Code Basis" for tests (Stage 1), it lacks any mechanism to send this data to external third-party domains. The instructions explicitly warn against including real API keys in files or logs, recommending the use of environment variables instead.
  • [REMOTE_CODE_EXECUTION]: The skill generates HTML files that include client-side JavaScript for rendering Mermaid diagrams. This execution occurs within the user's browser context for viewing documentation and is a standard feature for technical documentation tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 07:05 AM
Security Audit — agent-trust-hub — prd-test-writer