stitched-full-page-capture
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's core script
scripts/stitch_full_page_capture.mjsexecutes system binariesffmpegandsipsusingnode:child_processfunctions (spawnandexecFile). These tools are used for cropping, stitching, and validating images, which is consistent with the skill's primary purpose and documented workflow. - [DYNAMIC_EXECUTION]: The script uses Playwright's
page.evaluate()to execute JavaScript within the browser context to handle scrolling and calculate page dimensions. This is standard behavior for browser automation tools and is used here to ensure lazy-loaded content is rendered. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data as it navigates to external URLs provided in a manifest file using Playwright (
page.goto). - Ingestion points: Reads
pageUrlfrom a localmanifest.jsonfile and visits these URLs via a browser session. - Boundary markers: None identified for URL navigation; the tool relies on standard browser isolation.
- Capability inventory: Uses
playwrightfor browser control andffmpeg/sipsfor image file processing. - Sanitization: Numerical inputs like
qualityandstepare validated/casted, but thepageUrlis passed directly to the browser's navigation function.
Audit Metadata