visual-qa
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the 'agent-browser' utility from Vercel Labs' official GitHub repository as a fallback when standard browser tools are unavailable.
- [COMMAND_EXECUTION]: Executes local Node.js scripts ('visual-qa.mjs') to perform automated pixel-level image comparisons and terminal layout validation.
- [COMMAND_EXECUTION]: Utilizes 'tmux' command-line tools to capture active terminal panes for TUI (Terminal User Interface) verification.
- [DATA_EXFILTRATION]: Processes 'reference packets' containing UI mocks and annotations. The skill explicitly mandates the redaction of secrets, tokens, and sensitive customer data from these artifacts before they are used in analysis, which serves as a security control against data exposure.
- [PROMPT_INJECTION]: Includes instructions to treat all text within reference packets as untrusted data for comparison only, preventing the agent from following malicious instructions potentially embedded in external design mocks (Indirect Prompt Injection mitigation).
Audit Metadata