feature-demo
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The
record-demo.mjsscript utilizes dynamicimport()to execute JavaScript logic from.demo.mjsfiles. These files, which define the demonstration steps and setup, are executed within the Node.js environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes external project data, such as git history and development plans, to determine what features to record. This ingestion process constitutes an indirect prompt injection surface. However, the skill mitigates risk by implementing a strict policy to intercept and abort non-GET network requests during the recording phase, preventing unauthorized data writes.
- [COMMAND_EXECUTION]: The skill operates by executing Node.js scripts and utilizes
npmto install dependencies likeplaywright-corein a controlled manner outside the main project directory if necessary.
Audit Metadata