webdriverio-testing
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: The skill provides instructional content for a well-known, legitimate testing framework (WebdriverIO) and uses standard tooling like npm and npx. Examples use dummy data and placeholders for credentials, following security best practices.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to generate and execute tests based on external inputs such as page selectors and requirements. While this is a standard capability for testing skills, it creates an attack surface where untrusted data could influence agent actions. * Ingestion points: Test specification requirements and web page source code in SKILL.md. * Boundary markers: None explicitly mentioned in the instructions. * Capability inventory: Subprocess execution via
npx wdio, file system writes for test files and configurations, and network access through browser automation. * Sanitization: None explicitly defined in the provided examples. - [DYNAMIC_EXECUTION]: The skill references
ts-node/registerin the Cucumber configuration to enable runtime TypeScript execution. This is a standard development practice for the ecosystem and uses a static, well-known module path.
Audit Metadata