qa-phase
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a pre-release audit script (
pre-release-check.sh) located within the plugin's own directory structure (${PLUGIN_ROOT}). This is a standard automated task to ensure code quality before testing starts. - [DYNAMIC_EXECUTION]: The workflow involves generating test code and subsequently executing it using standard runners like Jest, Vitest, and Chrome MCP. This behavior is the primary intended purpose of the QA automation skill.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (design documents) to generate test plans. While this is an ingestion surface for untrusted data, it is a core functional requirement.
- Ingestion points: Reads design documents and check-phase analysis in the 'Context' step of SKILL.md.
- Boundary markers: None explicitly defined in the workflow instructions.
- Capability inventory: Uses
Bash,Write,Edit,Task, and Chrome MCP for E2E testing across various scripts. - Sanitization: No specific sanitization methods for ingested document content are mentioned.
Audit Metadata