verifier-web
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Uses Docker commands (
docker up,docker exec,docker logs) to manage the local development stack and verify backend state viapsql. - [COMMAND_EXECUTION]: Leverages the Playwright MCP for browser-based UI verification, including navigating to authentication flows and capturing screenshots as evidence.
- [EXTERNAL_DOWNLOADS]: Interacts with the official Stripe CLI for sandbox testing, including logging in and listening for webhooks on the local machine.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from local API logs and Stripe webhook logs to verify state and retrieve authentication codes.
- Ingestion points: Output from
docker logsandstripe-listen.log(SKILL.md). - Boundary markers: None present.
- Capability inventory: Uses
docker exec,psql,curl, and Playwright browser actions. - Sanitization: No explicit sanitization of log data is performed.
Audit Metadata