devdocs-test-run
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill identifies and executes test commands such as npx vitest run, npx jest, npx mocha, and python -m pytest by scanning project configuration files like package.json and pyproject.toml.
- [PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection (Category 8). 1. Ingestion points: It reads external test case documentation in docs/devdocs/03-test-cases*.md and scans source code for @verifies and @testcase annotations. 2. Boundary markers: There are no explicit instructions or delimiters provided to the agent to ignore or isolate natural language instructions that might be embedded within these external files. 3. Capability inventory: The skill is granted powerful capabilities including Bash for command execution and Write for file modification. 4. Sanitization: There is no evidence of validation or sanitization of the content extracted from the documentation or code files before it is used to influence the agent's logic or generate the final report.
Audit Metadata