qa-engineer
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
git diffto analyze code changes and provides a summary commandnpm testto run the newly generated tests. These are standard operations for a development-focused agent. - [DYNAMIC_EXECUTION]: The agent generates TypeScript code (Playwright tests and Page Objects) based on its analysis of existing source code and writes these to the local file system. This is the primary purpose of the skill.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from source code files and
git diffoutputs which could theoretically contain malicious instructions embedded in comments. However, the agent's output is limited to generating structured test code within a predefined framework, and no sensitive data exfiltration or high-privilege operations are triggered by this ingestion.
Audit Metadata