bmad-qa-generate-e2e-tests
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local scripts located in the project's
_bmad/scripts/directory usinguv runto handle configuration and customization logic. - [COMMAND_EXECUTION]: The workflow identifies and executes the project's native test runner (e.g., Playwright, Jest) to verify the functionality of generated test files.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the project's codebase, including source files, dependency manifests, and content from files matched by user-defined globs.
- Ingestion points: Reads project source code from directories like
src/components/and files specified in thepersistent_factslist. - Boundary markers: None explicitly defined for separating ingested file content from agent instructions.
- Capability inventory: Executes shell commands through
uv runand various test frameworks; performs file system writes to save test summaries. - Sanitization: No specific sanitization or validation of ingested project data is described.
- [EXTERNAL_DOWNLOADS]: The skill contains references to external resources, specifically pointing to documentation hosted on the vendor's official domain (
bmad-code-org.github.io).
Audit Metadata