verify-fix-loop

Pass

Audited by Gen Agent Trust Hub on Jul 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform environment checks and suggests running development servers in the background using run_in_background=true. It also provides a command for users to set up the Playwright MCP server using npx.
  • [EXTERNAL_DOWNLOADS]: The documentation instructs the user to install and run the Playwright MCP server from the NPM registry using the command npx -y @playwright/mcp@latest. This is a reference to a well-known technology tool.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data from web pages (via snapshots, console logs, and network requests) and uses this data to drive code modification tasks.
  • Ingestion points: Browser data is collected in Phase A using mcp__playwright__browser_snapshot, mcp__playwright__browser_console_messages, and mcp__playwright__browser_network_requests.
  • Boundary markers: The skill employs a structured 'PASS criteria' checklist and a Domain Specific Language (DSL) to define expected outcomes, which helps constrain the evaluation logic.
  • Capability inventory: The agent has access to Read, Edit, Write, Bash, and Agent tools to modify the local file system and execute commands based on its analysis.
  • Sanitization: The skill does not explicitly describe sanitization for the ingested browser content, but it implements mandatory human-in-the-loop (HITL) checkpoints starting from the third iteration to prevent autonomous drift or malicious instruction following.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 10, 2026, 08:27 AM
Security Audit — agent-trust-hub — verify-fix-loop