visant-killer

Pass

Audited by Gen Agent Trust Hub on Nov 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script killer-scan.mjs uses spawnSync to orchestrate various UI checkers, including npx impeccable detect, npm run audit:design, and other internal node scripts. This execution is directly linked to the skill's primary function of running UI linters.
  • [EXTERNAL_DOWNLOADS]: The skill relies on npx to execute external tools and resolves playwright or playwright-core from the project's dependencies or the npm cache. These are standard industry tools for design auditing and browser automation.
  • [DYNAMIC_EXECUTION]: The verify-screens.mjs and corta-url.mjs scripts use Playwright's page.evaluate to inject and run measurement scripts (corta-scan.js, ritmo-scan.js) in the browser context. This is required to calculate layout geometries (like overflow and clipping) that cannot be determined through static analysis alone.
  • [DATA_EXPOSURE]: The auditing workflow includes a dev-login process (/api/auth/dev-login) to allow testing of screens behind authentication. It manages an auth_token in localStorage and optionally reads DEV_EMAIL from the environment. These operations are scoped to the local development environment and used specifically for auditing purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 2, 2026, 01:19 PM