qa-requirements-generator
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external URLs via Playwright and repository code via the Filesystem MCP. Malicious instructions hidden within these sources (e.g., in HTML or code comments) could manipulate the agent's behavior during the requirement extraction process.
- Ingestion points: Playwright MCP accessibility snapshots (from-url) and Filesystem MCP repository scans (from-code).
- Boundary markers: Absent. The instructions do not specify delimiters to separate untrusted data from system instructions.
- Capability inventory: Includes network navigation (Playwright) and file reading (Filesystem), but lacks write or system-modifying permissions.
- Sanitization: Absent. No filtering or validation of the ingested external content is defined.
- [COMMAND_EXECUTION]: The skill employs the Filesystem MCP to read codebase structures and schemas. While intended for requirement derivation, this provides the capability to read any file within the project's accessible scope.
- [EXTERNAL_DOWNLOADS]: The from-url sub-mode navigates the agent to external, potentially untrusted URLs, which involves network connectivity to domains specified at runtime.
Audit Metadata