Unit Test Automation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:01 AM UTC
• Version: 2.0.2

Overview

This skill performs disclosed local setup for frontend unit testing, with project-scoped file changes and Git hook automation that fit its stated purpose.

Before installing, expect it to modify your project by adding test dependencies, Vitest setup files, .claude command prompts, and a Husky pre-commit hook. Review those generated files in repositories where Git hooks or AI-assisted test generation need team approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger scenarios are broad, need-based, and include generic requests like initializing or configuring tests across multiple frontend stacks. In an agent system, this can cause the skill to activate in situations where the user did not clearly consent to privileged actions such as shell execution, dependency installation, file writes, and Git hook modification, increasing the chance of unintended codebase changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow explicitly authorizes automatic modification of test code and repeated re-runs, but it does not require user confirmation, preview of changes, or clear warning that project files may be edited. In an agent-driven environment, this can lead to unintended code changes, masking underlying product defects by rewriting tests to fit current behavior, or silently altering repository state.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The phrase 'setup unit test' is short and conversationally common, making it prone to accidental matching in normal discussion. Because this skill performs privileged operations including shell commands, package installation, file generation, and Husky hook changes, accidental activation could lead to unwanted project modifications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Line L74 instructs users to 'use English to describe expected behavior,' which imposes a specific language requirement. This is a natural-language policy concern because the file does not offer a language choice or explain a justified locale-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/check-missing-tests.mjs:33

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/detect-framework.mjs:32