awt-e2e-testing
Fail
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions and metadata recommend the installation of external code from an unverified GitHub repository using the command
npx skills add ksgisang/awt-skill --skill awt -g. - [PERSISTENCE]: The inclusion of the
-g(global) flag in the recommended installation command attempts to modify the agent's global environment, establishing persistence across different sessions. - [INDIRECT_PROMPT_INJECTION]: As a tool designed for E2E web testing using visual matching and OCR, the skill is inherently vulnerable to indirect prompt injection. Malicious instructions embedded in the web pages being tested (via text or images) could influence the agent's behavior during execution.
- Ingestion points: Web pages processed via Playwright, OpenCV template matching, and OCR.
- Boundary markers: None identified in the provided documentation.
- Capability inventory: Playwright browser interaction, SQLite database operations, and interaction with various AI provider APIs.
- Sanitization: No evidence of sanitization for web-scraped content or visual data before processing.
- [COMMAND_EXECUTION]: The skill relies on Playwright to execute browser-based actions and commands, which constitutes a significant capability tier when combined with untrusted input from the web.
Recommendations
- AI detected serious security threats
Audit Metadata