ecc-cmd-e2e
Warn
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill generates TypeScript code for test journeys and executes it using the command line.
- Evidence: File
references/upstream-command.mddocuments the flow of generating test code and executing it vianpx playwright test. - [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes and interacts with untrusted data from external web pages during test execution.
- Ingestion points: The agent reads and verifies content from web pages being tested (e.g., page titles, locator text, API responses) as shown in
references/upstream-command.md. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands in tested content are present.
- Capability inventory: The skill can execute shell commands, read/write files (test scripts and artifacts), and capture screenshots/videos.
- Sanitization: No sanitization or validation of the content retrieved from tested pages is documented before being used in logic or reports.
- [EXTERNAL_DOWNLOADS]: The skill references the use of
npx, which downloads packages from the official NPM registry if they are not present locally. - Evidence:
references/upstream-command.mdcontains the commandnpx playwright test.
Audit Metadata