testland/junit-xml-analysis
Parses JUnit-format XML reports (the de-facto interchange format every CI ingests - Jenkins, GitHub Actions, GitLab, Buildkite, CircleCI) into structured, machine-readable per-suite and per-case metrics tables (passed / failed / errored / skipped, time, classname, message, stack), groups failures by classname for trend analysis, and distinguishes "new failures vs flakes" by cross-referencing the `flakyFailure` and `rerunFailure` rerun elements. Use when the downstream consumer is a dashboard, script, or aggregator - not when the goal is a human-readable prose summary (use test-run-summary-author for that). Single-run, in-XML aggregation only; for cross-run cross-environment roll-ups, use a cross-run test-suite aggregator.
69
87%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The runtime path reads and parses the CI-emitted JUnit XML file (e.g., `python scripts/parse_junit.py junit.xml` and `ET.parse(path)`), where the XML contents—including free text like failure/error messages and stack traces—can be outsider-authored by submitting crafted test outputs.
Where we found it
JUnit XML test report file
content-type · 3 sites
The plugin parses CI-emitted JUnit XML files whose free-text content (failure messages, error messages, stack traces, system-out/err) can be outsider-authored via crafted test outputs in a PR, creating an indirect prompt-injection vector.
SKILL.md
78
tree = ET.parse(path)
references/junit-xml-parsing.md
12
const xml = parser.parse(readFileSync(path, 'utf8'));
37
run: python scripts/parse_junit.py junit.xml > analytics.json
- Audited
- Security analysis