playwright-test
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Playwright testing framework and Chromium browser binaries from official repositories and Microsoft's distribution services as part of the standard environment setup.
- [COMMAND_EXECUTION]: Uses the Bash tool to perform project maintenance tasks, including package installation via
npm installand executing the test runner throughnpx playwright test. - [REMOTE_CODE_EXECUTION]: Generates local JavaScript test specifications based on user-provided feature descriptions and project files, which are subsequently executed by the Playwright test runner.
- [PROMPT_INJECTION]: The skill processes external project files like
Form.xmlanddesign.mdto influence the generation of test logic, presenting a surface for indirect prompt injection. - Ingestion points:
Form.xml,design.md, and the project'sCLAUDE.mdconfiguration file. - Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore embedded commands in these files.
- Capability inventory: The skill has access to
Bash,Read,Write, andEdittools. - Sanitization: No specific sanitization or validation steps are outlined for the content extracted from XML or Markdown files before interpolation into the test script.
Audit Metadata