e2e-testing
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to manage the testing environment, including
npm initfor setup,npx playwright installfor browser binaries, andlsoffor port detection as described inworkflow/phase-2-setup.mdanddata/framework-detection-patterns.yaml. - [EXTERNAL_DOWNLOADS]: Fetches official Playwright components and browser engines (Chromium, Firefox, WebKit) from Microsoft's registries. It also references documentation and configuration from well-known services like Tailwind CSS, React, and Next.js.
- [REMOTE_CODE_EXECUTION]: Uses
npm init playwright@latestwhich involves downloading and executing a remote initialization script from the official Playwright registry. This is standard procedure for initializing Playwright projects and originates from a trusted provider. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data from the user's local project files (e.g.,
package.json, source code) to drive its discovery and analysis phases. Ingestion points: Readspackage.jsonand project source files (workflow/phase-1-discovery.md). Boundary markers: Absent; the skill relies on pre-defined templates for code generation. Capability inventory: Executesnpm/npxcommands, writes files to the filesystem, and launches browsers via Playwright. Sanitization: Employs YAML parsing and regex for error and version analysis.
Audit Metadata