app-validation
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- Command Execution: The skill utilizes local shell commands like
npm run test:fabricandnpx rayfin upto initialize testing environments. These are routine development operations used to orchestrate application deployment and validation.\n- Browser Security Configuration: Instructions include a configuration to disableLocalNetworkAccessChecksin Chromium. This is a standard requirement for development scenarios where a secure cloud portal (Fabric) must communicate with a local development server (localhost). Users should be aware that this reduces browser restrictions specifically for the testing session.\n- Session Persistence: The use of the--persistentflag in Playwright is encouraged to store cookies and session state. This allows for automated testing that bypasses repetitive login screens, relying on a one-time manual authentication by the user.\n- Dynamic Browser Code Execution: The skill provides JavaScript snippets for use with Playwright'srun-codefeature. These scripts perform diagnostic tasks like frame discovery and console error categorization, which are part of the intended functionality for identifying application issues.\n- Indirect Prompt Injection Surface: The skill processes external data by inspecting frame URLs and console error messages. \n - Ingestion points: Frame walker and console message listeners in
SKILL.mdandreferences/fabric-embed.md.\n - Boundary markers: None explicitly present in the diagnostic snippets.\n
- Capability inventory: Local shell execution and JavaScript execution within the browser context.\n
- Sanitization: Data from the browser environment is categorized based on source URL patterns to filter out platform noise.
Audit Metadata