mobile-viewport-audit
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted data from external websites' DOM (Document Object Model) via the
mcp__playwright__browser_evaluatefunction inSKILL.md. - Ingestion points: Data enters the context from any URL the user provides for auditing.
- Boundary markers: None used when passing the extracted DOM data back to the agent.
- Capability inventory: Uses Playwright MCP tools for browser navigation, resizing, and JavaScript evaluation.
- Sanitization: The skill performs basic sanitization by truncating extracted text content using
.slice(0, 30)to limit the amount of untrusted text processed by the model. - [EXTERNAL_DOWNLOADS]: The skill navigates to external URLs provided by the user and references the author's domain (helpmetest.com) for additional services. These are standard features for a web-based auditing tool and do not involve downloading or executing untrusted binary or script files on the host system.
Audit Metadata