appbuilder-e2e-testing
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies the project type and generates tailored tests by scanning the local workspace structure. 1. Ingestion points: Detection of
web-src/directories,@adobe/uix-guestdependencies inpackage.json, andapp.config.yamlconfiguration. 2. Boundary markers: Absent, as the skill relies on direct file system inspection. 3. Capability inventory: The skill has permissions for file system operations (Read, Write) and shell execution (Bash) to install dependencies and run tests. 4. Sanitization: Absent; the skill templates test code based on discovered folder and file names. This vulnerability surface is considered low risk and inherent to the skill's primary function. - [EXTERNAL_DOWNLOADS]: The skill initiates the download of the Chromium browser binary via the official Playwright command (
npx playwright install chromium). This is a standard operation for browser-based testing tools and targets a well-known service. - [COMMAND_EXECUTION]: The skill uses standard package management and Adobe-specific CLI tools (
npm,npx,aio) to manage the testing lifecycle, which is appropriate for its intended use case.
Audit Metadata