qa-visual-testing

Pass

Audited by Gen Agent Trust Hub on Mar 24, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use shell commands to interact with the local development environment and execute tests.
  • The agent is guided to use netstat, lsof, or curl to identify the active Vite development port on localhost before initiating browser-based interactions.
  • The test suite is executed via npm run test:e2e, which is a standard mechanism for running Playwright tests in a Node.js project.
  • [PROMPT_INJECTION]: The skill establishes a surface for processing untrusted qualitative data through its visual analysis helpers, characteristic of indirect prompt injection risks.
  • Ingestion points: Design specifications (GDD) are accepted as plain text in functions like checkGDDCompliance to be evaluated against screenshots.
  • Boundary markers: The provided code templates do not implement specific delimiters or safety instructions to isolate these external design specifications from the agent's core operational instructions.
  • Capability inventory: The agent possesses browser automation capabilities through Playwright (page.evaluate) and shell command execution.
  • Sanitization: No input validation or filtering of the GDD specification text is described before it is passed to the analysis helpers.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 24, 2026, 08:12 PM