add-to-homescreen-flow-tests
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill implements standard PWA testing procedures based on official web.dev guidelines.
- [SAFE]: File system interactions are restricted to the local project directory for reading configuration and writing test snapshots.
- [SAFE]: The generated Playwright scripts use standard, documented APIs for browser automation and manifest validation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project manifest data and source code from public/manifest.webmanifest and src/ to derive test cases. While the capability involves reading untrusted project data and writing to the tests/ directory (using cat and grep), there are no boundary markers or explicit sanitization steps, but the risk is restricted to the development environment.
- [COMMAND_EXECUTION]: The skill utilizes basic shell commands to gather project metadata, which is standard behavior for development and testing tools.
Audit Metadata