security-headers

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements a runtime observation mechanism using Playwright to inspect how websites handle cookies, network requests, and security headers in a real browser environment.
  • [SAFE]: Includes a synthetic data leakage detection system ('canary' data) that checks if test identity values (email, name, phone) are exfiltrated to third-party domains in various encoded formats (Base64, URL-encoded, MD5, SHA256).
  • [SAFE]: Employs safety guards in observe-runtime.mjs to prevent the automated submission of forms on non-local origins unless explicitly authorized by the user, protecting production environments from unintended side effects.
  • [SAFE]: The dynamic loading of the Playwright dependency in lib/browser.mjs is used for optional feature enhancement and follows standard Node.js patterns for resolving local or global modules.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 07:44 AM