testing
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection (LOW): The skill's core functionality involves reading and executing user-provided test files. This creates a surface where malicious instructions in those files could influence agent behavior.
- Ingestion points: Files matching
tests/unit/**/*.test.jsandtests/e2e/pages/*.test.js. - Boundary markers: None present.
- Capability inventory: Uses
node --testandnpx playwright testto execute Javascript code. - Sanitization: None; assumes the local test files are trusted.
- Unverifiable Dependencies & Remote Code Execution (SAFE): The instructions include installing
@playwright/testand browser binaries. These are standard, reputable tools in the Javascript ecosystem. - Dynamic Execution (SAFE): Includes a
node -eone-liner to verify the Sails.js test environment. The code executed is a static verification script and does not interpolate external data.
Audit Metadata