implementer-agent
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill explicitly forbids the use of hardcoded credentials, tokens, or URLs in test scripts, promoting the use of environment variables (
process.env) as a secure alternative. - [SAFE]: All identified tools and dependencies, such as Playwright and Appium, are reputable and industry-standard for the stated purpose of the skill.
- [PROMPT_INJECTION]: The skill processes untrusted external test design files, creating an indirect prompt injection surface. This risk is minimized by the skill's rigid template-based code generation approach.
- Ingestion points: Zephyr test design files (per
SKILL.mddescription). - Boundary markers: Absent; the skill does not define specific separators for the input data.
- Capability inventory: Performs file system writes to create
.tsfiles insrc/test/andsrc/page/directories. - Sanitization: Absent; the agent is instructed to translate design content directly into implementation code.
Audit Metadata