smoke-testing-web-games

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/smoke-test.mjs uses createRequire to dynamically load the playwright module from a path computed at runtime using the current working directory. This pattern allows the utility to adapt to different project environments but qualifies as dynamic loading from a computed path.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content by navigating a headless browser to a user-provided URL or local file and reporting the resulting console errors and exceptions. This creates a surface where a malicious page could inject instructions into the reported logs to influence the AI agent.\n
  • Ingestion points: The target argument in scripts/smoke-test.mjs which accepts arbitrary URLs and file paths.\n
  • Boundary markers: None; the output from the browser is not wrapped in markers to distinguish it from the skill's instructions.\n
  • Capability inventory: JavaScript execution via Playwright and monitoring of all console output and runtime exceptions.\n
  • Sanitization: The script does not perform any sanitization or escaping of the messages captured from the browser environment before reporting them to the user or agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 01:00 PM