visant-killer
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
killer-scan.mjsusesspawnSyncto orchestrate various UI checkers, includingnpx impeccable detect,npm run audit:design, and other internal node scripts. This execution is directly linked to the skill's primary function of running UI linters. - [EXTERNAL_DOWNLOADS]: The skill relies on
npxto execute external tools and resolvesplaywrightorplaywright-corefrom the project's dependencies or the npm cache. These are standard industry tools for design auditing and browser automation. - [DYNAMIC_EXECUTION]: The
verify-screens.mjsandcorta-url.mjsscripts use Playwright'spage.evaluateto inject and run measurement scripts (corta-scan.js,ritmo-scan.js) in the browser context. This is required to calculate layout geometries (like overflow and clipping) that cannot be determined through static analysis alone. - [DATA_EXPOSURE]: The auditing workflow includes a
dev-loginprocess (/api/auth/dev-login) to allow testing of screens behind authentication. It manages anauth_tokeninlocalStorageand optionally readsDEV_EMAILfrom the environment. These operations are scoped to the local development environment and used specifically for auditing purposes.
Audit Metadata