playwright-testing

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the user to execute standard development commands, including npm install, npx playwright install, and npm run dev. These commands are routine for setting up and running a Playwright testing environment.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing official packages like @playwright/test and using Playwright's built-in command to download browser binaries. These resources are from a well-known service (Microsoft) and are standard requirements for the tool.
  • [DATA_EXFILTRATION]: The link validator and site crawler utilities perform network requests using request.get() to URLs discovered on the target website. While this involves outbound network activity, it is the intended primary purpose of the link-checking functionality.
  • [PROMPT_INJECTION]: The provided link crawler utility in e2e/tests/site-links.spec.ts creates an indirect prompt injection surface by processing and acting upon external data.
  • Ingestion points: URLs are extracted from HTML href attributes using page.locator('a[href]').all().
  • Boundary markers: No specific boundary markers or instruction-ignoring delimiters are used for the discovered URLs.
  • Capability inventory: The skill uses page.goto() for navigation and request.get() to perform status checks on external links.
  • Sanitization: The code filters for basic non-navigational protocols (mailto, tel, anchor) but does not validate the target domains or URLs.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 04:17 PM
Security Audit — agent-trust-hub — playwright-testing