typescript-e2e-testing
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to execute tests (
npm run test:e2e), manage Docker infrastructure (docker-compose), and handle log files. These operations are core to the skill's purpose as a developer tool and are used within a defined testing context. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from test logs and failure reports stored in temporary files (
/tmp/e2e-*). There is a theoretical risk that malicious output generated by a compromised test suite could attempt to influence the agent's subsequent debugging steps. - Ingestion points:
/tmp/e2e-${E2E_SESSION}-output.log,/tmp/e2e-${E2E_SESSION}-debug.log(referenced inreferences/common/debugging.mdand various workflows). - Boundary markers: None explicitly implemented for reading log files.
- Capability inventory: Shell command execution via
npm,docker-compose, and filesystem utilities (grep,tail,rm). - Sanitization: No specific sanitization or filtering of log content is performed before reading.
- [EXTERNAL_DOWNLOADS]: The skill references standard Docker images (e.g.,
mongo:7.0,redis:7-alpine,postgres:15-alpine,redpandadata/redpanda) from public registries to facilitate infrastructure setup. These are well-known, legitimate sources for development dependencies.
Audit Metadata