playwright
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to use MCP tools to navigate to target pages, take snapshots, and document selectors based on the actual DOM structure. This creates an ingestion point for untrusted data from external websites. If an attacker controls the web page being analyzed, they could attempt to embed malicious instructions within HTML comments or invisible elements to influence the generated test scripts or the agent's behavior.
- Ingestion points: Target page snapshots and element documentation as defined in the 'MCP Workflow' section of
SKILL.md. - Boundary markers: None explicitly defined to separate the untrusted web content from the agent's instruction context.
- Capability inventory: The skill generates TypeScript code (
.spec.ts,-page.ts) and provides shell commands for running tests (npx playwright test). - Sanitization: No sanitization or filtering logic is mentioned for the data retrieved from snapshots.
- [COMMAND_EXECUTION]: The skill contains standard Playwright CLI commands (
npx playwright test,npx playwright test --ui, etc.). While these are routine for the intended use case, they represent the execution of shell commands based on the skill's environment.
Audit Metadata