Audit History

Most static external-command hits are Markdown or JavaScript backtick false positives. Real risks remain because the skill runs Node and npm commands, executes generated Playwright scripts from /tmp, and saves screenshots to shared temporary paths. I found no evidence of prompt injection, hidden external callbacks, or obfuscated payloads in SKILL.md.

Most static external-command hits are Markdown or JavaScript backtick false positives. Real risks remain because the skill runs Node and npm commands, executes generated Playwright scripts from /tmp, and saves screenshots to shared temporary paths. I found no evidence of prompt injection, hidden external callbacks, or obfuscated payloads in SKILL.md.

Static analysis flagged many command, network, filesystem, crypto, obfuscation, and path traversal patterns. Review found no malicious intent, no prompt injection attempt, and no real cryptographic or obfuscation behavior, but the skill intentionally guides Playwright script execution with browser network access and /tmp file artifacts.

This is a legitimate Playwright browser automation skill. All static findings are false positives: screenshot references are local /tmp writes, hardcoded URLs are localhost placeholders for dev testing, temp directory access is intentional for script isolation, and backticks are markdown code block delimiters. No malicious patterns, exfiltration, or dangerous command execution found.

This is a legitimate Playwright browser automation skill. All static findings are false positives: screenshot references are local /tmp writes, hardcoded URLs are localhost placeholders for dev testing, temp directory access is intentional for script isolation, and backticks are markdown code block delimiters. No malicious patterns, exfiltration, or dangerous command execution found.

This is a legitimate browser automation skill using Playwright. It writes test scripts to /tmp and executes them via Node.js to perform web testing, screenshot capture, form interaction, and accessibility audits. All functionality aligns with stated purpose.

This is a legitimate browser automation skill using Playwright. It writes test scripts to /tmp and executes them via Node.js to perform web testing, screenshot capture, form interaction, and accessibility audits. All functionality aligns with stated purpose.

This is a legitimate browser automation skill using Playwright. It writes test scripts to /tmp and executes them via Node.js to perform web testing, screenshot capture, form interaction, and accessibility audits. All functionality aligns with stated purpose.