shotation
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
shotationpackage from the official NPM registry vianpx shotation@latest. This is a standard method for running CLI tools in a Node.js environment. - [COMMAND_EXECUTION]: The skill executes various shell commands for UI auditing, including environment setup (
shotation setup android), project initialization (shotation init), and workflow captures (shotation capture). These are part of the core functionality for automating frontend testing and screenshot generation. - [INDIRECT_PROMPT_INJECTION]: The skill processes external configuration and scenario files which represent a potential surface for indirect instructions.
- Ingestion points: The skill reads project-specific configuration from
shotation.registry.jsonand scenario definitions from files specified via the--scenariosflag. - Boundary markers: No specific delimiters or warnings for embedded instructions are defined for these configuration files.
- Capability inventory: The skill possesses the capability to execute shell commands for building the application and running UI automation.
- Sanitization: The instructions do not specify explicit sanitization or validation of the contents of the configuration or scenario files.
Audit Metadata