browser-recording
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard
npx playwrightcommands to run browser tests andffmpegcommands for video post-processing and GIF conversion. - [DYNAMIC_EXECUTION]: The skill involves generating and executing Playwright configuration files and test specs at runtime, which is standard behavior for browser automation tools.
- [EXTERNAL_DOWNLOADS]: The skill instructions facilitate the download of browser binaries (Chromium) using the official Playwright installation tool from Microsoft.
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from external web pages during recording sessions, which represents a potential surface for indirect prompt injection.
- Ingestion points: Content of web pages navigated by Playwright as defined in the spec files (e.g., SKILL.md example navigates to localhost:3000).
- Boundary markers: Not explicitly defined in the skill logic.
- Capability inventory: Shell command execution (npx, ffmpeg) and file system writes for recording outputs.
- Sanitization: No specific sanitization for browser-rendered content is mentioned.
Audit Metadata