app-validation

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • Command Execution: The skill utilizes local shell commands like npm run test:fabric and npx rayfin up to initialize testing environments. These are routine development operations used to orchestrate application deployment and validation.\n- Browser Security Configuration: Instructions include a configuration to disable LocalNetworkAccessChecks in Chromium. This is a standard requirement for development scenarios where a secure cloud portal (Fabric) must communicate with a local development server (localhost). Users should be aware that this reduces browser restrictions specifically for the testing session.\n- Session Persistence: The use of the --persistent flag in Playwright is encouraged to store cookies and session state. This allows for automated testing that bypasses repetitive login screens, relying on a one-time manual authentication by the user.\n- Dynamic Browser Code Execution: The skill provides JavaScript snippets for use with Playwright's run-code feature. These scripts perform diagnostic tasks like frame discovery and console error categorization, which are part of the intended functionality for identifying application issues.\n- Indirect Prompt Injection Surface: The skill processes external data by inspecting frame URLs and console error messages. \n
  • Ingestion points: Frame walker and console message listeners in SKILL.md and references/fabric-embed.md.\n
  • Boundary markers: None explicitly present in the diagnostic snippets.\n
  • Capability inventory: Local shell execution and JavaScript execution within the browser context.\n
  • Sanitization: Data from the browser environment is categorized based on source URL patterns to filter out platform noise.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 09:56 PM