playwright-recording

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes reference code for calculating video durations using child_process.execSync to run ffprobe commands. This is a standard pattern for media automation and metadata extraction tasks.\n- [INDIRECT_PROMPT_INJECTION]: Browser automation instructions involve visiting external websites via page.goto(). This introduces an attack surface for untrusted external content, though the skill's primary focus is visual recording rather than parsing or executing instructions from the page content.\n- [EXTERNAL_DOWNLOADS]: The setup instructions guide users to install the Playwright framework and its associated browser binaries through official package managers (npm) and well-known CLI tools.\n- [DYNAMIC_EXECUTION]: The skill demonstrates the use of page.evaluate() to inject and execute JavaScript within the browser context to visualize interactions, such as cursor movements and click ripple effects, which is consistent with the skill's recording purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 12:35 AM