vitest-midscene-e2e
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones a repository containing project boilerplate from the vendor's official GitHub account (github.com/web-infra-dev/midscene-example.git) to a local directory (~/.midscene/boilerplate/).
- [COMMAND_EXECUTION]: Executes a local shell script (scripts/clone-boilerplate.sh) to manage the installation and periodic updates of the project boilerplate. The script performs standard git operations and file status checks.
- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality relies on Midscene AI interpreting application UI state and natural language instructions. This creates a surface where text or attributes within a target application's UI could potentially influence the agent's behavior.
- Ingestion points: UI element descriptions, text, and labels retrieved from Web (Playwright), Android (ADB), or iOS (WDA) view hierarchies via ctx.agent.
- Boundary markers: No explicit delimiters or instructions are provided in the prompts to distinguish between user instructions and potentially malicious content embedded in the application UI.
- Capability inventory: The agent has the capability to perform UI interactions (clicks, keyboard input), write to the file system (project scaffolding), and trigger shell-based test execution.
- Sanitization: There is no documented mechanism for filtering or sanitizing content retrieved from the target application before it is processed by the AI agent.
Audit Metadata