free-roam-testing
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill incorporates strong safety guardrails, requiring the agent to confirm the testing environment (ephemeral/preview preferred) and identity (dedicated test accounts) before execution. It also references a 'never-touch' list to prevent destructive actions.
- [COMMAND_EXECUTION]: The skill instructs the agent to use 'input fuzz payloads' including common security probes (e.g., XSS scripts, SQL injection strings, and path traversal like
../../etc/passwd). These are intended for testing the target application's validation logic rather than for exploitation and are contextually appropriate for a software testing tool. - [DATA_EXFILTRATION]: The skill captures browser state (console logs, network requests, screenshots) and transmits it to external issue trackers like Linear or GitHub. While this involves data movement, it is the core intended function of the skill for reporting discovered bugs.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) as it processes untrusted data from web pages and existing tickets.
- Ingestion points: Application UI, console logs, network responses, and existing bug tickets (SKILL.md).
- Boundary markers: Safety boundaries are defined for the environment, but no specific prompt delimiters or 'ignore' instructions are provided for the ingested data itself.
- Capability inventory: Browser automation tools and ticket filing capabilities (linear-planning).
- Sanitization: The instructions do not specify sanitization or escaping of the application data before it is recorded in tickets.
Audit Metadata