The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The capture-verify.mjs script connects to a browser instance via Chrome DevTools Protocol (CDP) and can execute arbitrary JavaScript within the page context using Runtime.evaluate. This is a functional requirement used to settle the page state (e.g., closing modals or hiding specific elements) before capturing the screenshot.
[DYNAMIC_EXECUTION]: All included scripts (beautify.mjs, capture-verify.mjs, screenshot-verify.mjs) implement a loadSharp function that dynamically resolves the sharp image processing library. This function searches for the library in local node_modules or .pnpm store directories by walking up the file system tree, which is a portability mechanism for specific monorepo or pnpm-based environments.
[INDIRECT_PROMPT_INJECTION]: The capture-verify.mjs script accepts a preCapture JavaScript string through a JSON command-line argument. This represents an attack surface where an agent, if directed by untrusted input, could execute malicious code within the browser session.
Ingestion points: specJson command-line argument in scripts/capture-verify.mjs.
Boundary markers: None. The script parses the JSON and evaluates the preCapture string directly.
Capability inventory: Arbitrary JavaScript execution in the browser context via Runtime.evaluate; local file system writes via fs.writeFileSync to the output path and /tmp/last-capture.png.
Sanitization: None. The script executes the provided expression without filtering.

agent-first-screenshots