dodds-testing-practices
Fail
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: HIGHPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill title header contains a significant volume of non-printing zero-width Unicode characters (U+200B, U+200C, U+200D, U+2060). This technique is a characteristic method for hiding instructions or metadata from human reviewers while ensuring they are processed by the AI agent, often used to bypass security controls or inject malicious behavior.
- [PROMPT_INJECTION]: The obfuscated string appended to the title encodes a binary payload. In the context of an AI skill, the use of such hidden payloads is considered a high-risk indicator of an attempt to manipulate agent logic or perform unauthorized background actions.
- [PROMPT_INJECTION]: The skill processes user-provided React code and testing requirements at runtime without the use of explicit boundary markers or input sanitization. This creates an attack surface for indirect prompt injection, as malicious instructions embedded within the processed code could potentially influence the agent's output or behavior.
Recommendations
- AI detected serious security threats
Audit Metadata