qa-visual-testing
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use shell commands to interact with the local development environment and execute tests.
- The agent is guided to use
netstat,lsof, orcurlto identify the active Vite development port onlocalhostbefore initiating browser-based interactions. - The test suite is executed via
npm run test:e2e, which is a standard mechanism for running Playwright tests in a Node.js project. - [PROMPT_INJECTION]: The skill establishes a surface for processing untrusted qualitative data through its visual analysis helpers, characteristic of indirect prompt injection risks.
- Ingestion points: Design specifications (GDD) are accepted as plain text in functions like
checkGDDComplianceto be evaluated against screenshots. - Boundary markers: The provided code templates do not implement specific delimiters or safety instructions to isolate these external design specifications from the agent's core operational instructions.
- Capability inventory: The agent possesses browser automation capabilities through Playwright (
page.evaluate) and shell command execution. - Sanitization: No input validation or filtering of the GDD specification text is described before it is passed to the analysis helpers.
Audit Metadata