browser-tdd
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
npx playwright testto run automated browser tests. - [DYNAMIC_EXECUTION]: The skill utilizes the Playwright framework to dynamically execute JavaScript within a browser context for verifying DOM structure, computed styles, and interactive behaviors.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it interacts with web content and browser DOM which may originate from untrusted sources.
- Ingestion points: Web pages and DOM elements accessed via
page.goto()andpage.locator()inSKILL.md. - Boundary markers: Not explicitly defined in the provided test templates, though the skill context is constrained to developer testing.
- Capability inventory: Command-line execution via
npxand file system writes for screenshots (page.screenshot). - Sanitization: The skill explicitly mandates 'Test Payload Sanitization' to prevent the inclusion of real PII or sensitive tokens in test fixtures.
Audit Metadata