dev-design
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The review-harness/resolve-playwright.mjs script performs dynamic loading of the Playwright library using the import() function. The path to the library is resolved at runtime based on the project directory provided to the script. While this is necessary for the harness to function within the project's specific environment, dynamic loading from computed paths is a noted security surface.
- Evidence: Found in review-harness/resolve-playwright.mjs:
const mod = await import(pathToFileURL(resolved).href);. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and render HTML prototypes which are described as potentially containing untrusted code or being derived from external user input. This creates an attack surface for indirect prompt injection. The skill implements significant defensive architecture to mitigate this, including a split-origin server model, Content Security Policy (CSP) enforcement, and sandboxed iframes to isolate the prototype context from the review API.
- Ingestion points: prototype/proposal.html (defined in internal/design-review.md).
- Boundary markers: The skill uses a two-origin server (review vs asset) and sandboxed iframes (allow-scripts allow-forms allow-modals allow-same-origin) to prevent the prototype from accessing the session API.
- Capability inventory: The harness executes a browser for screenshot capture (capture.mjs), starts local servers (server.mjs), and performs file writes to the session directory.
- Sanitization: The server enforces a strict CSP (default-src 'self' 'unsafe-inline' data: blob:;) and validates paths to prevent directory traversal.
- [COMMAND_EXECUTION]: The skill's workflow involves executing multiple local Node.js scripts that manage the review lifecycle. These scripts perform system-level tasks such as file manipulation, process management for the review server, and browser automation.
- Evidence: Scripts preflight.mjs, server.mjs, and capture.mjs are executed via Node.js as part of the skill's primary operation.
Audit Metadata