animate
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill writes and executes local JavaScript files (
_animate_verify.mjsand_animate_auth.mjs) using thenoderuntime to automate UI testing and session management. - [EXTERNAL_DOWNLOADS]: The skill performs automated installation of the
@playwright/testpackage and the Chromium browser engine. These are legitimate development tools provided by Microsoft. - [CREDENTIALS_UNSAFE]: The instructions for Phase 0e recommend passing authentication credentials (
TEST_EMAILandTEST_PASSWORD) directly via environment variables on the command line. This practice can leave sensitive data in shell history. - [PROMPT_INJECTION]: The skill reads from a
DESIGN-BRIEF.mdfile in the project root to determine operational parameters like animation levels. - Ingestion points:
DESIGN-BRIEF.mdlocated in the project root. - Boundary markers: Absent.
- Capability inventory: Shell command execution, browser automation via Playwright, and local file writing.
- Sanitization: Absent; the agent is instructed to use the content of the file directly to guide its behavior.
Audit Metadata