latchshot-page-capture
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Node.js script (
scripts/latchshot.mjs) to perform web captures. The script is well-structured and uses built-in Node.js modules for file operations and networking. - [DATA_EXFILTRATION]: The skill intentionally sends public URLs to a specific hosted service (
https://latchshot.fly.dev) for rendering. It includes multiple security checks to prevent sensitive information from being sent, such as:- Rejecting URLs with embedded credentials (username/password).
- Restricting ports to standard web ports (80, 443).
- Requiring explicit confirmation (
--allow-query) before sending URLs with query strings to avoid accidental token exposure. - Restricting captures to public HTTP/HTTPS pages and explicitly rejecting local file access or internal network IPs.
- [CREDENTIALS_UNSAFE]: The skill correctly handles the
LATCHSHOT_API_KEYby reading it exclusively from the environment. It explicitly forbids passing the key as a command-line argument and includes redaction logic in its error handling to prevent the key from appearing in logs or console output.
Audit Metadata