web-verify-patcher

Pass

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is designed as an analytical tool for security researchers and developers to evaluate web verification systems. It maintains a strong security posture by prioritizing the analysis of offline evidence (HTML snippets, local screenshots) before suggesting any active browser-based取证 (acquisition). It includes explicit instructions to pause and seek user confirmation before starting any browser tools, ensuring human-in-the-loop control.
  • [SAFE]: The skill implements safety boundaries. scripts/classify_verify.py includes a boundary_flags function that monitors for keywords associated with malicious intent (e.g., 'bypass', 'mass signup', 'credential stuffing') and provides guidance to the agent to stick to authorized testing and identification.
  • [COMMAND_EXECUTION]: The script scripts/verify_recipe_eval.py uses subprocess.run to execute internal scripts (e.g., scripts/map_coordinates.py) to verify their functionality during a self-test phase. This execution is constrained to scripts within the skill's own directory, uses the current Python interpreter via sys.executable, and is part of a deterministic verification workflow rather than a vector for arbitrary command injection.
  • [EXTERNAL_DOWNLOADS]: The documentation suggests the use of well-known third-party libraries (e.g., ddddocr, opencv-python, Pillow) and browser tools (e.g., Camoufox, CloakBrowser). These are standard industry tools for image processing and anti-fingerprinting analysis, and their installation requires manual user action.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 9, 2026, 01:43 PM
Security Audit — agent-trust-hub — web-verify-patcher