website-story
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled content from
POSITIONING.mdto generateSTORY.md. While this constitutes a standard data ingestion surface, the skill implements strict mapping rules (e.g., 'every line in STORY.md must be traceable to a line in POSITIONING.md') which mitigates the risk of arbitrary instruction execution. This interaction is central to the skill's primary purpose. - [DYNAMIC_EXECUTION]: The skill generates a Playwright test file (
story.spec.ts) from a static template. This is a standard template-based file generation task intended for developer use and does not involve runtime compilation or injection of untrusted code.
Audit Metadata