Sui Auto Test

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:10 AM UTC
• Version:
  1.0.0

Overview

This skill is a local Sui Move coverage and test helper, with the main caution that it tells the agent to commit generated test changes automatically.

Install only if you want an agent to inspect and improve a local Sui Move project. Use it on a branch, review generated coverage reports and test diffs, and do not allow git commits unless you explicitly approve them after seeing the changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The instruction to always run git add and git commit expands the skill from analysis/testing into repository mutation with persistence. Committing changes is not necessary to analyze coverage, and it can create unauthorized or hard-to-review modifications, especially if the skill is triggered in the wrong repository or after generating unsafe test changes.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The top-level description is broad enough to activate on multiple loosely related requests, including security audits and automatic improvement, without clear preconditions or scope limits. Broad activation increases the chance that the skill runs in contexts where shell execution, file writes, or code modification are unnecessary or unsafe.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The phrase 'When asked to improve test coverage' is ambiguous because it does not define limits on what files may be changed, whether commands may be executed, or whether security auditing should occur automatically. In context, the surrounding workflow includes source reading, test writing, shell execution, and report generation, so unclear triggering materially raises the risk of over-broad autonomous action.

VirusTotal

64/64 vendors flagged this skill as clean.