frontend-playwright
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web content via browser navigation tools, creating a vulnerability surface where instructions from external pages could influence agent behavior.
- Ingestion points: The browser_navigate tool (SKILL.md, references/tools.md) loads external URLs and local development servers.
- Boundary markers: No explicit markers are used to distinguish untrusted page data from agent instructions.
- Capability inventory: Includes high-interaction tools such as browser_click, browser_type, and browser_evaluate (references/tools.md).
- Sanitization: No sanitization of ingested content is specified.
- [DYNAMIC_EXECUTION]: Documentation promotes the use of browser_evaluate to execute arbitrary JavaScript strings within the browser context.
- Evidence: references/tools.md includes examples for accessing localStorage and computed styles.
- [CREDENTIALS_UNSAFE]: The skill documentation provides examples for handling sensitive data such as authentication tokens and passwords.
- Evidence: references/tools.md shows retrieving a token from localStorage. references/workflows.md includes a hardcoded test password 'password123'.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to start a local development server.
- Evidence: SKILL.md includes the instruction to run 'npm run dev'.
Audit Metadata