stitched-full-page-capture
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/stitch_full_page_capture.mjsusesffmpegfor image stitching andsipsfor dimension checking. These are handled via safe subprocess calls with array-based arguments. - [EXTERNAL_DOWNLOADS]: The skill performs browser navigation to external URLs via Playwright to capture screenshots, which is the primary intended behavior.
- [INDIRECT_PROMPT_INJECTION]: The skill reads from a local
manifest.jsonfile to guide its actions. - Ingestion points:
manifest.jsondata parsed byJSON.parse. - Boundary markers: None; uses trusted local configuration.
- Capability inventory: Browser automation, file system writing, and execution of local image processing binaries.
- Sanitization: Uses
path.joinfor file paths and array arguments for subprocess execution to prevent injection. - [SAFE]: No obfuscation, persistence, or data exfiltration behaviors were identified. The skill's implementation is consistent with its documentation.
Audit Metadata