update-chrome-binaries-test-region

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several shell commands to manage the AWS environment and local build processes.
  • Runs aws sts get-caller-identity to verify the active AWS account (678892195805).
  • Uses eval "$(aws configure export-credentials --format env)" to bridge AWS SSO/Identity Center credentials into the environment for the Lambda client.
  • Executes local scripts and tools including bun src/admin/make-layer-public.ts, curl -sI, and ./run.sh (Docker tests).
  • [EXTERNAL_DOWNLOADS]: Fetches Chrome version metadata from a well-known service (Google's Chrome for Testing repository on GitHub Pages).
  • Targets https://googlechromelabs.github.io/chrome-for-testing/known-good-versions-with-downloads.json.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external JSON source which could theoretically be manipulated to influence the version strings used in the build.
  • Ingestion points: SKILL.md (via reference to the Google Chrome for Testing JSON metadata).
  • Boundary markers: Not explicitly defined for the external data ingestion.
  • Capability inventory: Includes shell command execution, AWS Lambda layer publication, and file system writes.
  • Sanitization: The skill includes a manual verification step using curl -sI to ensure the binaries exist before the agent proceeds with updates, providing a check against invalid or malicious data.
  • [SAFE]: The resources and scripts referenced (e.g., packages/lambda, remotion.media) are internal to the vendor's repository structure and infrastructure, representing legitimate administrative functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 06:47 PM