web-verify-patcher
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed as an analytical tool for security researchers and developers to evaluate web verification systems. It maintains a strong security posture by prioritizing the analysis of offline evidence (HTML snippets, local screenshots) before suggesting any active browser-based取证 (acquisition). It includes explicit instructions to pause and seek user confirmation before starting any browser tools, ensuring human-in-the-loop control.
- [SAFE]: The skill implements safety boundaries.
scripts/classify_verify.pyincludes aboundary_flagsfunction that monitors for keywords associated with malicious intent (e.g., 'bypass', 'mass signup', 'credential stuffing') and provides guidance to the agent to stick to authorized testing and identification. - [COMMAND_EXECUTION]: The script
scripts/verify_recipe_eval.pyusessubprocess.runto execute internal scripts (e.g.,scripts/map_coordinates.py) to verify their functionality during a self-test phase. This execution is constrained to scripts within the skill's own directory, uses the current Python interpreter viasys.executable, and is part of a deterministic verification workflow rather than a vector for arbitrary command injection. - [EXTERNAL_DOWNLOADS]: The documentation suggests the use of well-known third-party libraries (e.g.,
ddddocr,opencv-python,Pillow) and browser tools (e.g.,Camoufox,CloakBrowser). These are standard industry tools for image processing and anti-fingerprinting analysis, and their installation requires manual user action.
Audit Metadata