shotation

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the shotation package from the official NPM registry via npx shotation@latest. This is a standard method for running CLI tools in a Node.js environment.
  • [COMMAND_EXECUTION]: The skill executes various shell commands for UI auditing, including environment setup (shotation setup android), project initialization (shotation init), and workflow captures (shotation capture). These are part of the core functionality for automating frontend testing and screenshot generation.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external configuration and scenario files which represent a potential surface for indirect instructions.
  • Ingestion points: The skill reads project-specific configuration from shotation.registry.json and scenario definitions from files specified via the --scenarios flag.
  • Boundary markers: No specific delimiters or warnings for embedded instructions are defined for these configuration files.
  • Capability inventory: The skill possesses the capability to execute shell commands for building the application and running UI automation.
  • Sanitization: The instructions do not specify explicit sanitization or validation of the contents of the configuration or scenario files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 10:25 PM