qa-discovery-interview
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it is designed to ingest and process data from external sources (live web applications via Playwright MCP) and local sources (project codebase via Filesystem MCP). Maliciously crafted content within these sources, such as hidden instructions in HTML or code comments, could potentially influence the agent's logic during the brief generation phase.
- Ingestion points: User interview responses, project files (code, configs, documentation) via
read_file(Filesystem MCP), and live application content vianavigate(Playwright MCP). - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when handling content retrieved from the codebase or external URLs.
- Capability inventory: Filesystem read/write access, Playwright-based web navigation, and session persistence via Memory MCP.
- Sanitization: There are no documented procedures for sanitizing or validating external input before it is interpolated into the final QA Brief template.
- [DATA_EXFILTRATION]: The skill instructions explicitly direct the agent to read 'configs' and 'API routes' during Research Loops. While this is aligned with the primary purpose of technical discovery for QA, it creates a potential exposure risk for sensitive configuration data if the generated QA Brief is shared outside of secure environments or if the agent captures credentials stored within those files.
Audit Metadata