testrail-bug-report
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests and processes content from an external source (TestRail) that could contain instructions designed to manipulate the agent or the automated browser session.
- Ingestion points: Fetches test case content, including titles, preconditions, and steps, via the
mcp_testrail_getCasetool inSKILL.md. - Boundary markers: The instructions lack explicit delimiters or 'ignore' directives to isolate the retrieved test case data from the agent's control logic.
- Capability inventory: The skill possesses significant capabilities including browser navigation, form filling, network request analysis, and script evaluation via the Chrome DevTools MCP.
- Sanitization: While the skill advises removing HTML tags from TestRail content, it does not implement comprehensive sanitization or validation of the input strings.
- [COMMAND_EXECUTION]: The skill uses
mcp_chrome-devtoo_evaluate_scriptto execute JavaScript within the browser environment. This is used legitimately for investigating application state during test failures, but represents a mechanism for dynamic code execution.
Audit Metadata