unit-testing-test-generate
The skill is critically insecure because it passes unsanitized user input directly to a shell execution function, enabling arbitrary command injection with the agent's system privileges.
Skill Info
Install
Assessments (4)
AI Agent Traps ↗The `CoverageAnalyzer.analyze_coverage` method accepts a `test_command` string and passes it directly to `subprocess.run`. An attacker or malicious prompt could inject arbitrary shell commands (e.g., '; rm -rf /') into this argument.
subprocess.run([test_command, '--coverage', '--json'], ...)
The skill includes a function that executes arbitrary shell commands provided as input to `analyze_coverage`. This creates a command injection vector if the `test_command` argument is not strictly sanitized, as it allows the execution of any system command with the privileges of the AI agent.
subprocess.run([test_command, '--coverage', '--json'], capture_output=True, text=True)
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Badge
[](https://mondoo.com/ai-agent-security/skills/github/sickn33/antigravity-awesome-skills/unit-testing-test-generate)<a href="https://mondoo.com/ai-agent-security/skills/github/sickn33/antigravity-awesome-skills/unit-testing-test-generate"><img src="https://mondoo.com/ai-agent-security/api/badge/github/sickn33/antigravity-awesome-skills/unit-testing-test-generate.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/sickn33/antigravity-awesome-skills/unit-testing-test-generate.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow