umbraco-playwright-testhelpers
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents tools for interacting with external web APIs and parsing their response bodies (e.g.,
umbracoApi.getandJsonHelper.getBody). This introduces an attack surface where an agent might process untrusted data that could contain malicious instructions. - Ingestion points: The
JsonHelper.getBodymethod described inSKILL.mdis used to ingest response data from API calls. - Boundary markers: The documentation does not specify the use of delimiters or instructions to ignore embedded content in responses.
- Capability inventory: The skill utilizes
WebFetch,Read,Write, andEdittools as defined in the frontmatter. - Sanitization: No explicit content sanitization or validation methods are mentioned for the fetched data.
- [EXTERNAL_DOWNLOADS]: The documentation references the official
@umbraco/playwright-testhelpersNPM package and its source repository on GitHub. These references point to legitimate vendor infrastructure for the Umbraco ecosystem.
Audit Metadata