stitched-full-page-capture

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/stitch_full_page_capture.mjs executes external binaries ffmpeg and sips to process, crop, and stitch screenshot segments. Commands are invoked using spawn and execFile with argument arrays, which mitigates command injection risks.
  • [EXTERNAL_DOWNLOADS]: The skill navigates to external URLs provided in a local manifest file using the Playwright Chromium browser to capture web content.
  • [INDIRECT_PROMPT_INJECTION]: Because the skill processes live web pages, it possesses an ingestion point for untrusted data. However, the risk is negligible as the skill only captures visual snapshots and does not interpret or follow instructions found within the page text.
  • [DYNAMIC_EXECUTION]: The script dynamically loads the playwright library from the workspace's local node_modules using the createRequire method. This is a standard implementation for interacting with local environment dependencies.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:33 PM