stitched-full-page-capture
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/stitch_full_page_capture.mjsexecutes external binariesffmpegandsipsto process, crop, and stitch screenshot segments. Commands are invoked usingspawnandexecFilewith argument arrays, which mitigates command injection risks. - [EXTERNAL_DOWNLOADS]: The skill navigates to external URLs provided in a local manifest file using the Playwright Chromium browser to capture web content.
- [INDIRECT_PROMPT_INJECTION]: Because the skill processes live web pages, it possesses an ingestion point for untrusted data. However, the risk is negligible as the skill only captures visual snapshots and does not interpret or follow instructions found within the page text.
- [DYNAMIC_EXECUTION]: The script dynamically loads the
playwrightlibrary from the workspace's localnode_modulesusing thecreateRequiremethod. This is a standard implementation for interacting with local environment dependencies.
Audit Metadata