playwright-e2e-test
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests installing
@playwright/testand browser binaries from Microsoft's official Playwright registry. Playwright is a well-known tool from a trusted vendor, and this behavior is standard for the skill's primary purpose. - [COMMAND_EXECUTION]: The skill executes shell commands to install dependencies (
npm install), install browsers (npx playwright install), and run tests (npx playwright test). These operations are necessary for automated QA tasks and are scoped to the project environment. - [PRIVILEGE_ESCALATION]: The instructions include the command
sudo npx playwright install-depsfor installing system libraries. However, the skill explicitly directs the agent to "ask the user to run it — never try to obtain their password," ensuring the user retains control over elevated permissions. - [INDIRECT_PROMPT_INJECTION]: The skill involves reading project documentation and source code to understand application flows. While this introduces an attack surface where instructions in external project files could influence the agent, the skill mitigates this by requiring the agent to propose a plan in plain language and wait for user approval before taking any action.
Audit Metadata