design-review
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/setup-capture.mjsscript manages the installation of standard development dependencies includingplaywright,@axe-core/playwright,pixelmatch, andpngjsvia thenpmpackage manager. It also automates the download of the Chromium browser binary required for visual auditing. These libraries are well-known and trusted in the development community for testing and image processing. - [COMMAND_EXECUTION]: The skill uses Node.js and Python scripts to execute shell commands for environment setup and design review tasks. This includes executing
npm install,npx playwright install, and launching headless browser instances via Playwright to analyze live web routes and capture screenshots for visual evidence. - [DATA_EXFILTRATION]: Static analysis scripts (
accessibility-check.py,anti-pattern-check.py, andstate-check.py) include aping_telemetryfunction that performs a network request usingurllib.request.urlopen. This function is only activated if theADS_TELEMETRY_URLenvironment variable is defined and only transmits the name of the script being executed to track skill usage. It does not exfiltrate sensitive user data or local files.
Audit Metadata