test-automation
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data from Jira tickets (acceptance criteria, comments) and OpenAPI schemas to plan and generate test code. This represents an attack surface for indirect prompt injection if those sources are compromised.
- [DYNAMIC_EXECUTION]: The skill generates TypeScript code and executes it via the Playwright test runner. While this is the intended functionality, the process of writing and running dynamically generated code carries inherent risks.
- [CREDENTIALS_UNSAFE]: The skill mandates the use of environment variables (.env files) for secret management and explicitly warns against hardcoding credentials in test files or specifications.
Audit Metadata