replay-playwright

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download a legacy libssl1.1 package from the official Ubuntu archive (archive.ubuntu.com) to resolve library compatibility issues for the Replay browser on modern Linux distributions.
  • [COMMAND_EXECUTION]: The skill contains diagnostic commands and installation steps that utilize npx, npm, and curl to manage dependencies and tools. It also executes a command that uses Node.js to dynamically resolve the path to the Replay browser binary within the user's home directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to modify the user's playwright.config.ts and execute test projects. This creates an attack surface where untrusted data within the test project could potentially influence the agent's behavior during configuration or execution.
  • Ingestion points: Reading and modifying the project's playwright.config.ts file.
  • Boundary markers: None present; the agent is instructed to append or modify code directly.
  • Capability inventory: Subprocess execution (npx), file system modification (playwright.config.ts), and network operations (uploading test recordings via the reporter).
  • Sanitization: No specific sanitization or validation of the existing configuration file's content is described.
  • [DYNAMIC_EXECUTION]: The skill uses a node -e one-liner to calculate the local file path of a binary for diagnostic purposes. This dynamically generated command string is used to verify the installation environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 05:44 PM