typo3-14-update
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install a third-party DDEV add-on from 'codingsasi/ddev-playwright'. This is a well-known community utility for providing browser support within DDEV containers for testing purposes.
- [COMMAND_EXECUTION]: The skill executes multiple shell commands through the DDEV environment ('ddev composer', 'ddev typo3', 'ddev snapshot'). Additionally, the bundled Node.js scripts execute the 'odiff' binary via a subprocess to perform pixel-level image comparisons during visual regression testing.
- [DATA_EXPOSURE]: The 'backend-module-sweep.cjs' script is designed to read 'BE_USER' and 'BE_PASSWORD' credentials from local '.env' or '.env.local' files. These credentials are used exclusively for authenticating the automated tester against the local development backend.
- [COMMAND_EXECUTION]: The skill uses Node.js 'worker_threads' to parallelize the image comparison process, which involves executing comparison logic in separate threads for performance optimization during large-scale visual audits.
- [SAFE]: The skill demonstrates security best practices by explicitly restricting operations to the local DDEV environment and prohibiting any deployments or commands against production or remote infrastructure.
Audit Metadata