runtime-hygiene

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the playwright library and browser binaries. These are well-known, industry-standard tools for browser automation and testing.
  • [COMMAND_EXECUTION]: The provided Node.js script (runtime-watch.mjs) is designed to be executed by the developer or agent to audit a running web application. It also instructions standard commands like npm test and npm run build, which are typical for frontend development workflows.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The runtime-watch.mjs script captures data from external sources by monitoring browser console logs, uncaught exceptions, and promise rejections from any user-provided URL (scripts/runtime-watch.mjs).
  • Boundary markers: The script prints captured error messages and logs directly to the terminal or a JSON report file without utilizing specific delimiters or "ignore instructions" wrappers for the external content.
  • Capability inventory: The script has the capability to write to the local file system (via the --json flag) and perform interactions with web pages (clicks, reloads).
  • Sanitization: The script does not perform sanitization or escaping of the strings captured from the browser console or error events, meaning a malicious web page could intentionally trigger error messages containing instructions aimed at the agent processing the output.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 11:17 PM