spec-test
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard development test runners including
npm test,npx jest,pytest,go test, andcargo testas part of its core functionality. - [COMMAND_EXECUTION]: Test commands are dynamically determined by reading project configuration files such as
package.json,CLAUDE.md, andcoding-rules.md. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from project files and using it to influence shell command execution and file creation.
- Ingestion points: Reads task definitions from
tasks.md, design specs fromdesign.md, and environment configuration frompackage.jsonandCLAUDE.md. - Boundary markers: No explicit delimitation or instructions to ignore embedded instructions are present when processing these files.
- Capability inventory: The agent can execute shell commands via detected test runners and write test result files to the
.specs/directory. - Sanitization: No evidence of sanitization or validation of the input strings before they are incorporated into the test execution flow.
Audit Metadata