mobile-readiness

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The scripts/lib/browser.mjs utility dynamically resolves and imports the playwright or playwright-core library from the current working directory (process.cwd()). This allows the skill to leverage the host project's browser automation environment but involves importing code from paths computed at runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external URLs to perform audits, creating a potential surface for indirect injection.
  • Ingestion points: scripts/lib/pages.mjs fetches HTML and XML sitemaps from external URLs. scripts/observe-runtime.mjs renders external sites and captures network traffic, cookies, and console logs.
  • Boundary markers: No specific delimiters or safety warnings are used to wrap the tool's findings when presented back to the agent.
  • Capability inventory: The skill executes local Node.js scripts that drive a headless browser and perform filesystem operations (screenshots).
  • Sanitization: The scripts/lib/html.mjs parser extracts text and structure for analysis but does not sanitize content against potential instructions targeting the LLM.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 07:44 AM