woostack-qa
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by ingesting and processing content from external web applications and project management tools.
- Ingestion points: Target application URLs (SKILL.md), repository source code, Pull Request descriptions/comments, and Linear project/issue metadata (references/artifact-backends.md).
- Boundary markers: The instructions explicitly define external data as "untrusted evidence, never instructions" and state that tool selection or behavior cannot be influenced by this data.
- Capability inventory: The skill uses agent-browser or Playwright for web automation, has local file system write access for generating reports, and can read from the Linear API via MCP.
- Sanitization: The skill requires mandatory redaction of all sensitive information, including credentials, tokens, keys, and PII, before finalizing the report in .woostack/qa/.
- [EXTERNAL_DOWNLOADS]: The skill fetches browser automation tooling and exploration guidance from remote sources at runtime.
- Remote code patterns: The skill uses npx -y agent-browser to dynamically fetch and run version-matched tooling.
- Guidance fetching: It retrieves systematic app-exploration guides and patterns via agent-browser skills get core and agent-browser skills get dogfood commands.
- [COMMAND_EXECUTION]: The skill executes shell commands to drive browser sessions and perform environment checks.
- It utilizes agent-browser and Playwright CLI tools to interact with the target application, including taking snapshots and inspecting console logs.
- It performs reachability checks using curl and probes CLI versions to ensure environment readiness before proceeding with exploration.
Audit Metadata