qa-ui
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill architecture creates a surface for indirect prompt injection by processing untrusted data to drive autonomous code repair.\n
- Ingestion points: Data is collected from git diff outputs, local files in
~/.claude/plans/, and the live DOM of the application under test viamcp__chrome-devtools-direct__take_snapshot.\n - Boundary markers: There are no explicit boundary markers or instructions to the model to ignore potential directives embedded in the analyzed code or web content.\n
- Capability inventory: The skill can execute shell commands via Bash, perform browser interactions including arbitrary JavaScript execution (
evaluate_script), and trigger automated code edits by the primary agent based on the evaluator's output.\n - Sanitization: No sanitization or input validation is applied to the data retrieved from the application or git history before it is used to generate suggested fixes.\n- [COMMAND_EXECUTION]: The skill uses the
Bashtool andmcp__chrome-devtools-direct__evaluate_scriptto perform environment setup, browser automation, and version control operations. While these actions are intended for testing, they represent powerful execution primitives that could be redirected if the agent's instructions are subverted.\n- [CREDENTIALS_UNSAFE]: TheSKILL.mdfile includes a hardcoded test email address (corporate-advance-admin@example.com) used for automated login during QA runs. While specific to a development environment, hardcoding user identifiers is a discouraged practice.
Audit Metadata