Progressive Web App Testing
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
execSyncwithin the Lighthouse audit section to run the Lighthouse CLI vianpx. This is used to programmatically generate PWA reports and is consistent with the primary purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill defines tests that ingest and parse external, untrusted content such as Web App Manifests and HTML metadata. This creates a surface for indirect prompt injection if the agent were to process this content as instructions rather than raw data. Evidence found in the manifest validation tests.
- [DYNAMIC_EXECUTION]: The skill makes extensive use of
page.evaluateto execute JavaScript in the browser context. This is a necessary and standard method for interacting with browser-specific APIs like Service Workers, the Cache API, and IndexedDB during automation testing.
Audit Metadata