skills/cskiro/claudex/e2e-testing/Gen Agent Trust Hub

e2e-testing

Pass

Audited by Gen Agent Trust Hub on Apr 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to manage the testing environment, including npm init for setup, npx playwright install for browser binaries, and lsof for port detection as described in workflow/phase-2-setup.md and data/framework-detection-patterns.yaml.
  • [EXTERNAL_DOWNLOADS]: Fetches official Playwright components and browser engines (Chromium, Firefox, WebKit) from Microsoft's registries. It also references documentation and configuration from well-known services like Tailwind CSS, React, and Next.js.
  • [REMOTE_CODE_EXECUTION]: Uses npm init playwright@latest which involves downloading and executing a remote initialization script from the official Playwright registry. This is standard procedure for initializing Playwright projects and originates from a trusted provider.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data from the user's local project files (e.g., package.json, source code) to drive its discovery and analysis phases. Ingestion points: Reads package.json and project source files (workflow/phase-1-discovery.md). Boundary markers: Absent; the skill relies on pre-defined templates for code generation. Capability inventory: Executes npm/npx commands, writes files to the filesystem, and launches browsers via Playwright. Sanitization: Employs YAML parsing and regex for error and version analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 4, 2026, 01:31 PM