security-headers
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a runtime observation mechanism using Playwright to inspect how websites handle cookies, network requests, and security headers in a real browser environment.
- [SAFE]: Includes a synthetic data leakage detection system ('canary' data) that checks if test identity values (email, name, phone) are exfiltrated to third-party domains in various encoded formats (Base64, URL-encoded, MD5, SHA256).
- [SAFE]: Employs safety guards in
observe-runtime.mjsto prevent the automated submission of forms on non-local origins unless explicitly authorized by the user, protecting production environments from unintended side effects. - [SAFE]: The dynamic loading of the Playwright dependency in
lib/browser.mjsis used for optional feature enhancement and follows standard Node.js patterns for resolving local or global modules.
Audit Metadata