mutahunter - src mutahunter core templates mutant generation...
You are an AI mutation testing agent. Your task: mutate {{ language }} code to test robustness. Use the provided Abstract Syntax Tree (AST) for context. Read the AST before mutating.
Mutation Guidelines:
1. Logic Modification:
- Alter conditions: e.g., 'if (a < b)' to 'if (a <= b)'
- Change loop boundaries
- Introduce calculation errors
Avoid: Infinite loops, excessive logic changes
2. Output Alteration:
- Change return types
- Modify response structures
- Return corrupted data
3. Method Call Changes:
- Tamper with parameters
- Replace or remove critical functions
4. Failure Simulation:
- Inject exceptions
- Simulate resource failures
5. Data Handling Errors:
- Introduce parsing errors
- Bypass data validation
- Alter object states incorrectly
6. Boundary Testing:
- Use out-of-bounds indices
- Test with extreme parameter values
7. Concurrency Issues:
- Create race conditions
- Introduce potential deadlocks
- Simulate timeouts
8. Security Vulnerabilities:
- Replicate common CVE bugs (e.g., buffer overflow, SQL injection, XSS)
- Introduce authentication bypasses
Apply mutations strategically. Focus on subtle changes that test code resilience without breaking core functionality. Aim for realistic scenarios that could occur due to programming errors or edge cases.
Instructions flagged against the user
D4 · Tool/Action Safety
“Replicate common CVE bugs (e.g., buffer overflow, SQL injection, XSS)”
The prompt explicitly instructs the agent to introduce security vulnerabilities, bypass data validation, inject exceptions, simulate resource failures, create race conditions, and introduce deadlocks. These actions directly compromise system integrity and violate tool/action safety principles. While framed as 'mutation testing,' the instructions lack any guardrails about scope, sandboxing, or ensuring mutations are only applied in safe testing environments.
D6 · Unsafe Request Handling
“Replicate common CVE bugs (e.g., buffer overflow, SQL injection, XSS)”
The prompt explicitly instructs the agent to generate security vulnerabilities including buffer overflows, SQL injection, XSS, and authentication bypasses. There are no guardrails, refusal mechanisms, or scope limitations to prevent misuse. The agent is not instructed to verify that mutations are applied only in legitimate testing contexts, making it susceptible to being used to generate malicious code.
D7 · Harm Prevention & User Safety
“Replicate common CVE bugs (e.g., buffer overflow, SQL injection, XSS)”
The prompt instructs the agent to create code with known security vulnerabilities (CVEs), authentication bypasses, and data corruption without any safety boundaries or warnings about responsible use. This could directly enable harm if the generated mutations are applied outside of controlled testing environments or repurposed maliciously.