e2e-pr-stabilizer
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses GitHub CLI (
gh), Git, and various Node.js package managers (pnpm,npm,yarn,bun) to interact with the repository, manage pull requests, and execute test suites. These are standard operations for a development automation agent. - [DYNAMIC_EXECUTION]: To verify that new locators resolve correctly before committing a fix, the skill generates a temporary Playwright script (
selector-probe.spec.ts) and executes it. This controlled generation and execution of code is limited to the specific purpose of selector validation against the local application. - [EXTERNAL_DOWNLOADS]: The skill fetches historical telemetry data from Dash0 using an MCP server and can download CI artifacts (
trace.zip) from GitHub as a fallback if local reproduction fails. These operations target well-known and trusted services to provide evidence for test repairs. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources including pull request metadata and Playwright trace artifacts. While these serve as inputs for code analysis and repair, the skill is designed to use this data for technical diagnosis, and the workflow requires empirical verification of all generated code fixes through local execution streaks.
Audit Metadata