qa-gameplay-testing

Pass

Audited by Gen Agent Trust Hub on Mar 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local shell commands for environment preparation and test execution.\n
  • Uses netstat and curl to identify active development server ports on localhost (SKILL.md).\n
  • Executes npm run dev and npm run test:e2e for server lifecycle management and test suites (SKILL.md).\n
  • Includes instructions for manual process management and cleanup using TaskStop (SKILL.md).\n- [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection during testing.\n
  • Ingestion points: Data from the game environment enters the agent context via page.evaluate() (to access window properties like playerState) and through DOM interrogation using page.locator() (SKILL.md).\n
  • Boundary markers: There are no explicit delimiters or instructions to ignore potential commands embedded in the game state.\n
  • Capability inventory: The skill possesses capabilities including shell command execution, background task management, and automated browser control (SKILL.md).\n
  • Sanitization: No validation or sanitization of data retrieved from the browser context is specified before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 24, 2026, 08:12 PM