live-env-playwright
Fail
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill contains an explicit instruction to output sensitive credentials (SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD) during execution. Standard security practices require that secrets remain masked and are never printed to logs or user interfaces.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the following mechanisms:
- Ingestion points: The agent navigates to and reads data from external web addresses provided in NEXT_PUBLIC_APP_URL via Playwright MCP tools.
- Boundary markers: There are no defined delimiters or instructions to the agent to disregard potentially malicious commands embedded in the web page content or console logs.
- Capability inventory: The agent can automate browser actions, capture screenshots, read network logs, and write files to the local repository (artifacts/ directory).
- Sanitization: While the skill suggests stripping tokens from network logs, it lacks overall sanitization for page content or console messages which could contain hidden instructions.
Recommendations
- AI detected serious security threats
Audit Metadata