e2e-codegen
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates TypeScript code and immediately executes it using
npx playwright test <file>. This is a core functionality intended to verify that the generated test passes in a headless environment before completion. - [EXTERNAL_DOWNLOADS]: The skill depends on the
@playwright/testNode.js package for its testing framework and execution environment. - [PROMPT_INJECTION]: The skill processes potentially untrusted scenario data to generate executable code, which presents an indirect prompt injection surface.
- Ingestion points: Reads verified scenarios from tools like
flow-runner,network-assertion, orscenario-mapper(SKILL.md). - Boundary markers: None; the skill does not explicitly use delimiters or instructions to ignore malicious content embedded within the source scenarios.
- Capability inventory: The skill has the ability to write files to the
tests/directory and execute shell commands vianpx. - Sanitization: The instructions do not describe sanitization or validation of the input scenario steps before they are converted into executable TypeScript code.
Audit Metadata