browser-tdd

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using npx playwright test to run automated browser tests.
  • [DYNAMIC_EXECUTION]: The skill utilizes the Playwright framework to dynamically execute JavaScript within a browser context for verifying DOM structure, computed styles, and interactive behaviors.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it interacts with web content and browser DOM which may originate from untrusted sources.
  • Ingestion points: Web pages and DOM elements accessed via page.goto() and page.locator() in SKILL.md.
  • Boundary markers: Not explicitly defined in the provided test templates, though the skill context is constrained to developer testing.
  • Capability inventory: Command-line execution via npx and file system writes for screenshots (page.screenshot).
  • Sanitization: The skill explicitly mandates 'Test Payload Sanitization' to prevent the inclusion of real PII or sensitive tokens in test fixtures.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:43 PM