visual-parity-verification
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several internal Python and Node.js scripts (e.g.,
scripts/parity_map.py,scripts/capture-snapshots.mjs,scripts/diff_snapshots.py) to manage verification workflows, capture UI state, and perform diffing analysis. - [EXTERNAL_DOWNLOADS]: The skill requires the
playwrightpackage for browser automation. As documented inreferences/capture.md, the tool expects this dependency to be present in the host environment (viaNODE_PATHornode_modules). - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill interacts with external web pages and retrieves DOM subtrees for comparison.
- Boundary markers: Uses structured manifest and ledger files to scope the analysis, along with specific React root selectors.
- Capability inventory: Includes script execution (Python/Node), file system writes (for snapshots and session ledgers), and network access via the Playwright-driven browser.
- Sanitization: Extracted DOM data is parsed and normalized into a rigid JSON schema before comparison.
- [DYNAMIC_EXECUTION]: The skill injects local JavaScript files (
scripts/find-react-roots.browser.jsandscripts/snapshot-subtree.browser.js) into the browser context of target applications using Playwright'spage.addScriptTagandpage.evaluatemethods.
Audit Metadata