stitched-full-page-capture

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/stitch_full_page_capture.mjs uses ffmpeg for image stitching and sips for dimension checking. These are handled via safe subprocess calls with array-based arguments.
  • [EXTERNAL_DOWNLOADS]: The skill performs browser navigation to external URLs via Playwright to capture screenshots, which is the primary intended behavior.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads from a local manifest.json file to guide its actions.
  • Ingestion points: manifest.json data parsed by JSON.parse.
  • Boundary markers: None; uses trusted local configuration.
  • Capability inventory: Browser automation, file system writing, and execution of local image processing binaries.
  • Sanitization: Uses path.join for file paths and array arguments for subprocess execution to prevent injection.
  • [SAFE]: No obfuscation, persistence, or data exfiltration behaviors were identified. The skill's implementation is consistent with its documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 04:26 PM