visual-parity-verification

Pass

Audited by Gen Agent Trust Hub on Nov 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several internal Python and Node.js scripts (e.g., scripts/parity_map.py, scripts/capture-snapshots.mjs, scripts/diff_snapshots.py) to manage verification workflows, capture UI state, and perform diffing analysis.
  • [EXTERNAL_DOWNLOADS]: The skill requires the playwright package for browser automation. As documented in references/capture.md, the tool expects this dependency to be present in the host environment (via NODE_PATH or node_modules).
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill interacts with external web pages and retrieves DOM subtrees for comparison.
  • Boundary markers: Uses structured manifest and ledger files to scope the analysis, along with specific React root selectors.
  • Capability inventory: Includes script execution (Python/Node), file system writes (for snapshots and session ledgers), and network access via the Playwright-driven browser.
  • Sanitization: Extracted DOM data is parsed and normalized into a rigid JSON schema before comparison.
  • [DYNAMIC_EXECUTION]: The skill injects local JavaScript files (scripts/find-react-roots.browser.js and scripts/snapshot-subtree.browser.js) into the browser context of target applications using Playwright's page.addScriptTag and page.evaluate methods.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 11, 2026, 02:05 PM