UX Friction Logger
Pass
Audited by Gen Agent Trust Hub on Jun 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the well-known @playwright/test package and associated browser binaries from official registries.
- [COMMAND_EXECUTION]: Provides instructions for standard environment setup and testing commands such as npm install and npx playwright install.
- [DATA_EXFILTRATION]: Generates and saves performance reports locally using the fs module, restricted to the project's own reporting directory.
- [PROMPT_INJECTION]: Analyzes external web content for heuristic evaluation, which represents a potential attack surface for indirect instructions. 1. Ingestion points: Web data is read via page.title() and page.$$eval in navigation-mapper.ts and heuristic-evaluation.spec.ts. 2. Boundary markers: No explicit separation between code logic and ingested text. 3. Capability inventory: File writing via fs.writeFileSync in friction-report.ts. 4. Sanitization: Content is used for analysis and reporting without explicit sanitization logic.
Audit Metadata