gauge-skill

Pass

Audited by Gen Agent Trust Hub on Feb 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the official Gauge download site at https://downloads.gauge.org/stable for CLI installation, which is a standard distribution channel for this well-known testing tool.- [COMMAND_EXECUTION]: The documentation includes various CLI commands necessary for using the framework, such as gauge install, gauge init, and gauge run. These are intended for user execution during project setup and testing phases.- [PROMPT_INJECTION]: The skill architecture creates a surface for indirect prompt injection because it processes user-provided test descriptions and scenarios to generate executable code. A malicious user could potentially embed instructions within a test scenario designed to influence the generated code's behavior or target the agent's logic during the generation process. * Ingestion points: User-provided test scenarios and step descriptions in .spec and .cpt files. * Boundary markers: None identified; user input is directly interpolated into code templates. * Capability inventory: The skill generates code capable of browser automation (Selenium), file system access (loading CSVs), and environment variable access. * Sanitization: No explicit sanitization or input validation logic is present in the provided patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 26, 2026, 10:48 AM