testland/traceability-matrix-builder
Build-an-X workflow that produces a requirements-to-tests traceability matrix from a TCM case repository + a requirements source (Jira / Linear / GitHub Issues). Walks the author through (1) extracting requirements with stable IDs, (2) extracting cases + their refs, (3) computing coverage (which requirements have at least one test, which tests verify which requirements, orphaned cases / orphaned requirements), (4) emitting a CSV / Markdown / HTML matrix, and (5) producing an executive summary (X% requirement coverage, Y orphans, Z over-tested). Use for test coverage audits, finding requirements-coverage gaps, sprint-end coverage reviews, compliance documentation, and traceability in regulated industries.
74
93%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The workflow’s required runtime ingests outsider-authored free text from Jira/GitHub/Linear issue titles and TCM case fields (including `refs`/link/tags) via its “extract requirements” and “extract cases + refs” steps, which are sourced from user-submitted issues and repository case content.
Where we found it
Jira issues (summaries/titles)
content-type · 4 sites
The plugin fetches Jira issues (both as requirements in Step 1 and as Xray tests in Step 2) and ingests their user-authored summary/title fields, which are outsider-authored free text susceptible to indirect prompt injection.
SKILL.md
44
issues = jira_search(jql)
SKILL.md
46
"title": i["fields"]["summary"]
SKILL.md
74
tests = jira_search(f'project = {project_key} AND issuetype = Test')
SKILL.md
81
"title": t["fields"]["summary"]
TestRail cases (titles and refs fields)
content-type · 3 sites
The plugin fetches TestRail cases and ingests their user-authored title and free-text refs fields, which are outsider-authored content susceptible to indirect prompt injection.
SKILL.md
66
for case in list_testrail_cases(project_id):
SKILL.md
67
refs = case.get("refs", "").split(",") if case.get("refs") else []
SKILL.md
68
"title": case["title"]
Linear issues (titles)
content-type · 2 sites
The plugin instructs the agent to fetch requirements from Linear issues, ingesting outsider-authored issue titles as free text susceptible to indirect prompt injection.
SKILL.md
33
Inventory the source - Jira project, Linear team, GitHub
SKILL.md
52
For Linear / GitHub Issues use the corresponding platform reference in
GitHub Issues (titles)
content-type · 3 sites
The plugin instructs the agent to fetch requirements from GitHub Issues, ingesting outsider-authored issue titles as free text susceptible to indirect prompt injection.
SKILL.md
33
Inventory the source - Jira project, Linear team, GitHub
SKILL.md
34
Issues label. Each requirement must have:
SKILL.md
52
For Linear / GitHub Issues use the corresponding platform reference in
- Audited
- Security analysis