accelint-ac-to-playwright
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to perform local shell operations including
npm install,npm run build, and execution of CLI tools likenpx generate-testsandnpx validate-plan. These commands are essential for preparing and running the skill's internal validation and translation logic. - [EXTERNAL_DOWNLOADS]: To set up its operational environment, the skill instructs the agent to run
npm install, which fetches standard dependencies (such aszod) from the official npm registry. This is a routine setup process for script-heavy AI agent skills. - [DYNAMIC_EXECUTION]: The workflow involves generating and executing transient Node.js scripts using bash heredocs (`node
- <<'NODE'
andcat << 'SCRIPT' | node`). These scripts are used to perform schema validation and target analysis on user-provided data within the agent's runtime environment, following pre-defined logic templates. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided acceptance criteria as its primary input.
- Ingestion points: User-provided
.featureand.mdfiles are read and parsed by the agent (defined inagents/assessment-mode.md). - Boundary markers: Data is isolated through structural transformations and JSON serialization during the conversion process.
- Capability inventory: The agent has the capability to write files to user-specified directories and execute shell commands for build processes (defined in
agents/conversion-mode.md). - Sanitization: The skill's translation engine (
scripts/translate-plan-to-tests.ts) utilizesJSON.stringifyfor value interpolation and safe regex construction to mitigate simple code injection risks in the generated test files.
Audit Metadata