create-e2e-tests
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various command-line tools for package management and testing, including
pnpm,npm,yarn,nx,ng,cypress, andplaywright. These actions are central to the skill's stated purpose and are governed by instructions to seek user approval before performing sensitive operations like managed server startup. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it reads and processes untrusted data from the local project environment to automate its testing logic.
- Ingestion points: Angular component source files (selectors and templates), application route definitions, and project configuration files (
nx.json,package.json,playwright.config.ts,cypress.config.ts). - Boundary markers: None identified. The instructions do not specify the use of delimiters or 'ignore' instructions when interpolating ingested data into prompts.
- Capability inventory: The skill is capable of installing NPM packages, writing new test files to the file system, and executing shell commands via project runners.
- Sanitization: None identified. Data extracted from the project files is used directly in shell commands and generated test scripts without explicit validation or escaping.
Audit Metadata