e2e-pr-stabilizer
Warn
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates a temporary Playwright test file (
tests/e2e/.tmp/selector-probe.spec.ts) during Phase 5 to verify if a new selector resolves against the live application. This generated script is then executed using theplaywright testcommand. This represents runtime code generation and execution based on analyzed evidence. \n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from Dash0 telemetry spans and Playwright trace artifacts, including HTML snapshots, console logs, and network data. This information is used to synthesize root-cause hypotheses and draft automated code fixes, creating a vulnerability surface where a malicious test environment or telemetry could influence the generated code. \n - Ingestion points: Dash0 telemetry spans (Phase 1) and Playwright
trace.zipfiles (Phase 2) as documented inrules/telemetry-driven-analysis.mdandrules/local-iteration.md. \n - Boundary markers: The skill does not define specific boundary markers for the LLM when processing this external data. \n
- Capability inventory: The skill has access to shell execution (
Bash), file system modification (Edit,Write), and remote repository interaction (git push). \n - Sanitization: The skill documents a "privacy pre-flight" in
rules/self-improvement-loop.mdto remove PII and credentials before persisting data to its memory loop. \n- [EXTERNAL_DOWNLOADS]: The skill downloads tooling and artifacts from external sources, includingnpx playwright init-agentsandgh run download. These operations target trusted services (Microsoft and GitHub) and are required for the skill's primary functionality. \n- [COMMAND_EXECUTION]: The skill relies on various CLI tools (git,gh,node,pnpm,rg,jq) to perform repository management, telemetry querying, and local test execution as part of its automated stabilization workflow.
Audit Metadata