gauge-skill
Pass
Audited by Gen Agent Trust Hub on Feb 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official Gauge download site at
https://downloads.gauge.org/stablefor CLI installation, which is a standard distribution channel for this well-known testing tool.- [COMMAND_EXECUTION]: The documentation includes various CLI commands necessary for using the framework, such asgauge install,gauge init, andgauge run. These are intended for user execution during project setup and testing phases.- [PROMPT_INJECTION]: The skill architecture creates a surface for indirect prompt injection because it processes user-provided test descriptions and scenarios to generate executable code. A malicious user could potentially embed instructions within a test scenario designed to influence the generated code's behavior or target the agent's logic during the generation process. * Ingestion points: User-provided test scenarios and step descriptions in.specand.cptfiles. * Boundary markers: None identified; user input is directly interpolated into code templates. * Capability inventory: The skill generates code capable of browser automation (Selenium), file system access (loading CSVs), and environment variable access. * Sanitization: No explicit sanitization or input validation logic is present in the provided patterns.
Audit Metadata