playwright
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official Playwright Docker images hosted on the Microsoft Artifact Registry (
mcr.microsoft.com/playwright). - [EXTERNAL_DOWNLOADS]: Instructions include fetching browser binaries and system dependencies using the standard Playwright CLI tools (
bunx playwright install). - [INDIRECT_PROMPT_INJECTION]: The skill operates on application code and live web environments, which constitutes an attack surface for indirect prompt injection.
- Ingestion points: The agent is instructed to process local spec files, project configurations, and browser-rendered content including DOM and ARIA trees (
SKILL.md,references/debugging-ci-advanced.md). - Boundary markers: No explicit delimiters or safety instructions are defined to protect the agent from potentially malicious instructions embedded in the target code or UI.
- Capability inventory: The workflow includes shell command execution via the Playwright CLI, file system access for reading configuration and writing reports, and network interactions through automated browser sessions.
- Sanitization: There is no documentation of input sanitization or filtering of external data before it enters the agent's context.
Audit Metadata