report
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to run tests via
npx playwright testand capture output usingteeandls. These are standard developer operations for CI/CD and local testing workflows.- [DATA_EXFILTRATION]: The skill is designed to send test summaries to external endpoints usingcurl. This behavior is controlled by user-defined environment variables such asSLACK_WEBHOOK_URL, making the communication intentional and configurable by the user.- [SAFE]: The skill processes external data from test logs and JSON results, which presents an inherent surface for indirect prompt injection. However, this is expected behavior for a reporting tool. Evidence chain: (1) Ingestion points:test-results/andtest-output.log. (2) Boundary markers: Absent; test data is interpolated directly into templates. (3) Capability inventory: Network access viacurl, command execution vianpx, and file writes totest-reports/. (4) Sanitization: None identified for test names or error messages.
Audit Metadata