migrate-to-e2e
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for test discovery, project initialization, and test execution (e.g.,
npx playwright test --list,npx e2e init,npx e2e run,maestro test). It also usesgitto manage state and revert temporary code changes during defect verification. - [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute thee2epackage and associated tools from the NPM registry. These resources are associated with the skill's author, e2e-inc. - [INDIRECT_PROMPT_INJECTION]: The skill parses untrusted content from external sources which could serve as injection vectors.
- Ingestion points: Reads
MIGRATION.mdto resume progress; inventories source test suites by reading existing spec files (Maestro YAML, Playwright scripts, etc.); fetches project data from the TesterArmy MCP server. - Boundary markers: The skill includes instructions to verify the
MIGRATION.mdfile against the repository state before trusting its data. - Capability inventory: The agent can execute shell commands, modify files (migration logs and application code for defect checks), and interact with network-connected services via MCP.
- Sanitization: There is no mention of explicit sanitization or escaping of contents found within the processed test files or migration logs.
Audit Metadata