runtime-hygiene
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
playwrightlibrary and browser binaries. These are well-known, industry-standard tools for browser automation and testing. - [COMMAND_EXECUTION]: The provided Node.js script (
runtime-watch.mjs) is designed to be executed by the developer or agent to audit a running web application. It also instructions standard commands likenpm testandnpm run build, which are typical for frontend development workflows. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The
runtime-watch.mjsscript captures data from external sources by monitoring browser console logs, uncaught exceptions, and promise rejections from any user-provided URL (scripts/runtime-watch.mjs). - Boundary markers: The script prints captured error messages and logs directly to the terminal or a JSON report file without utilizing specific delimiters or "ignore instructions" wrappers for the external content.
- Capability inventory: The script has the capability to write to the local file system (via the
--jsonflag) and perform interactions with web pages (clicks, reloads). - Sanitization: The script does not perform sanitization or escaping of the strings captured from the browser console or error events, meaning a malicious web page could intentionally trigger error messages containing instructions aimed at the agent processing the output.
Audit Metadata