qe-quality-assessment
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
aqeCLI tool to perform quality assessments, check deployment readiness, and generate reports. This involves executing shell commands with various flags (e.g.,aqe quality assess --scope src/). - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the way it handles external data.
- Ingestion points: The skill ingests untrusted data from the
src/directory and external report files likereport.jsonduring assessment tasks. - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the analyzed code or reports in the agent workflow definitions.
- Capability inventory: The skill leverages sub-agents (
qe-quality-analyzer,qe-deployment-advisor) and CLI execution to process and act upon the results of the ingested data. - Sanitization: No evidence of sanitization, escaping, or validation of the external content is present before it is interpolated into agent tasks.
Audit Metadata