playwright-ci-caching
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides YAML templates for GitHub Actions and Azure DevOps that execute shell commands to extract version strings from project files and run installation scripts.
- Evidence:
run: | $propsPath = "Directory.Packages.props" ...inSKILL.md. - [DYNAMIC_EXECUTION]: The provided
build/playwright.ps1script dynamically locates the Playwright CLI binary on the file system by searching forMicrosoft.Playwright.dlland then executes the discovered command. - Evidence:
& $playwrightCmd.FullName @ArgumentsinSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill implements logic to parse
Directory.Packages.props(XML) to extract versioning information used as cache keys in CI/CD pipelines. - Ingestion points:
Directory.Packages.propsfile in the project root (SKILL.md). - Boundary markers: None; the script performs direct XML property access via PowerShell's XML accelerator.
- Capability inventory: Shell execution, file system discovery, and binary execution within the CI environment.
- Sanitization: None; the script assumes the project's package configuration file is a trusted source.
Audit Metadata