website-screenshots
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
npm run screenshotsfrom thedocs/site/directory. This command starts a temporary local loopback server to render UI components and capture images. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from
qualitylayer/src/ui/demo/website-gallery.tsto provide content for the screenshots. - Ingestion points: The fixture file
website-gallery.tsserves as the data source for scenes. - Boundary markers: No explicit prompt delimiters are mentioned for the fixture content.
- Capability inventory: The skill can execute npm commands and write WebP files to the
public/product/directory. - Sanitization: The skill description states that the screenshot command is configured to reject remote requests and real API calls.
Audit Metadata