pixel-perfect
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes provided local shell scripts (
scripts/validate-visual.shandscripts/summarize-validation.sh) to perform visual diffing and report summarization. It relies on standard, well-known command-line utilities includingjq,awk, and ImageMagick. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources such as live websites (via Chrome DevTools/Playwright) and Figma designs. This ingestion represents a potential attack surface for indirect prompt injection. However, the risk is minimized by the skill's strict multi-phase execution loop which separates DOM/style measurement from the final code generation phase.
- [EXTERNAL_DOWNLOADS]: The skill mentions prerequisites for standard open-source tools and platform-specific MCP servers required for its intended functionality.
Audit Metadata