playwright-recording
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes reference code for calculating video durations using
child_process.execSyncto runffprobecommands. This is a standard pattern for media automation and metadata extraction tasks.\n- [INDIRECT_PROMPT_INJECTION]: Browser automation instructions involve visiting external websites viapage.goto(). This introduces an attack surface for untrusted external content, though the skill's primary focus is visual recording rather than parsing or executing instructions from the page content.\n- [EXTERNAL_DOWNLOADS]: The setup instructions guide users to install the Playwright framework and its associated browser binaries through official package managers (npm) and well-known CLI tools.\n- [DYNAMIC_EXECUTION]: The skill demonstrates the use ofpage.evaluate()to inject and execute JavaScript within the browser context to visualize interactions, such as cursor movements and click ripple effects, which is consistent with the skill's recording purpose.
Audit Metadata