spec-test

Pass

Audited by Gen Agent Trust Hub on Mar 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard development test runners including npm test, npx jest, pytest, go test, and cargo test as part of its core functionality.
  • [COMMAND_EXECUTION]: Test commands are dynamically determined by reading project configuration files such as package.json, CLAUDE.md, and coding-rules.md.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from project files and using it to influence shell command execution and file creation.
  • Ingestion points: Reads task definitions from tasks.md, design specs from design.md, and environment configuration from package.json and CLAUDE.md.
  • Boundary markers: No explicit delimitation or instructions to ignore embedded instructions are present when processing these files.
  • Capability inventory: The agent can execute shell commands via detected test runners and write test result files to the .specs/ directory.
  • Sanitization: No evidence of sanitization or validation of the input strings before they are incorporated into the test execution flow.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 30, 2026, 08:56 AM