qe-security-visual-testing

Pass

Audited by Gen Agent Trust Hub on Feb 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the aqe command-line interface and the @agentic-qe/v3 Node.js package. These tools are central to the 'Agentic QE' ecosystem provided by the author and are used for its core testing functionality.- [COMMAND_EXECUTION]: The skill's workflows involve executing the aqe CLI to automate visual audits, screenshot captures, and accessibility tests across multiple viewports.- [PROMPT_INJECTION]: The skill handles untrusted web content from external URLs, which presents an indirect prompt injection surface. * Ingestion points: Web page content and URLs provided to the audit commands (e.g., aqe test visual-audit --url). * Boundary markers: Explicit validation logic to block dangerous URL schemes such as javascript:, data:, and file:. * Capability inventory: Execution of CLI commands (aqe) and file system operations for saving screenshots and reports. * Sanitization: Automatic detection and masking (blurring/redaction) of PII, including emails, credit card numbers, and API keys, before data storage.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 27, 2026, 06:09 PM