testrail
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes the
npx playwright testcommand to run local test suites and capture results in JSON format. - [DYNAMIC_EXECUTION]: Generates Playwright test files (
.spec.ts) by interpolating external data from TestRail (titles, steps, and expected results) into predefined code templates. - [INDIRECT_PROMPT_INJECTION]: Processes untrusted data from TestRail which could potentially contain embedded instructions.
- Ingestion points: External test case data is fetched using the
testrail_get_casestool (SKILL.md). - Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded content when generating test code from TestRail data.
- Capability inventory: The skill possesses file-write capabilities (creating new test files) and shell execution capabilities (
npx playwright). - Sanitization: No specific sanitization or escaping mechanisms are described for handling the imported TestRail content before it is interpolated into executable test files.
Audit Metadata