ux-flow-auditor
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined task flows from JSON files to drive browser interactions and generate audit reports.
- Ingestion points:
scripts/trace_flow.pyreadsselector,value, andlabelfields from.heyeddi/docs/ux-flows/*.flow.jsonfiles, which are considered untrusted inputs from the repository. - Boundary markers: The resulting markdown report (
.heyeddi/docs/ux-flows/<task>.md) lacks explicit boundary markers or warnings to distinguish between potentially untrusted content (like error messages or step labels) and the agent's instructions. - Capability inventory: The skill is capable of navigating web pages, performing UI actions via Playwright, capturing screenshots, and writing files to the local
.heyeddidirectory. - Sanitization: Data from the flow definitions and runtime error messages are interpolated directly into the markdown report without sanitization or escaping, creating a surface for indirect prompt injection when the agent processes the report to add 'friction notes'.
Audit Metadata