qe-security-visual-testing
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
aqecommand-line interface and the@agentic-qe/v3Node.js package. These tools are central to the 'Agentic QE' ecosystem provided by the author and are used for its core testing functionality.- [COMMAND_EXECUTION]: The skill's workflows involve executing theaqeCLI to automate visual audits, screenshot captures, and accessibility tests across multiple viewports.- [PROMPT_INJECTION]: The skill handles untrusted web content from external URLs, which presents an indirect prompt injection surface. * Ingestion points: Web page content and URLs provided to the audit commands (e.g.,aqe test visual-audit --url). * Boundary markers: Explicit validation logic to block dangerous URL schemes such asjavascript:,data:, andfile:. * Capability inventory: Execution of CLI commands (aqe) and file system operations for saving screenshots and reports. * Sanitization: Automatic detection and masking (blurring/redaction) of PII, including emails, credit card numbers, and API keys, before data storage.
Audit Metadata