powercat-overpage
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- Trusted Resource Retrieval: The skill fetches its authoritative best-practice sources from a Microsoft-owned GitHub repository. This ensures the guidelines used for analysis are legitimate and maintainable.
- Local Data Processing: Instructions explicitly mandate that all artifacts, including the solution ZIP, HAR files, and findings, remain on the local file system. This is a positive security measure to prevent accidental data exposure to external services.
- Controlled Browser Interaction: The skill uses browser automation (Playwright) to facilitate the visualization of results in a local or specific viewer URL. This interaction is scoped to uploading the generated findings for user review.
- Structured Output Validation: The requirement to validate the generated JSON against a specific schema (
findings.schema.json) ensures that the agent's output remains predictable and safe for consumption by the viewer application. - Indirect Prompt Injection Surface: As an analysis tool, the skill processes untrusted external data (ZIP and HAR files). While this presents a theoretical surface for indirect prompt injection, the skill's reliance on structured reasoning and schema-validated output effectively mitigates the risk of the agent executing unintended actions based on the processed content.
Audit Metadata