qa-gameplay-testing
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell commands for environment preparation and test execution.\n
- Uses
netstatandcurlto identify active development server ports onlocalhost(SKILL.md).\n - Executes
npm run devandnpm run test:e2efor server lifecycle management and test suites (SKILL.md).\n - Includes instructions for manual process management and cleanup using
TaskStop(SKILL.md).\n- [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection during testing.\n - Ingestion points: Data from the game environment enters the agent context via
page.evaluate()(to accesswindowproperties likeplayerState) and through DOM interrogation usingpage.locator()(SKILL.md).\n - Boundary markers: There are no explicit delimiters or instructions to ignore potential commands embedded in the game state.\n
- Capability inventory: The skill possesses capabilities including shell command execution, background task management, and automated browser control (SKILL.md).\n
- Sanitization: No validation or sanitization of data retrieved from the browser context is specified before it is processed by the agent.
Audit Metadata