store-screenshots-panorama
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's Node.js scripts (
scripts/grid.mjsandscripts/render.mjs) use thechild_process.spawnmethod to execute a headless browser such as Google Chrome, Chromium, Microsoft Edge, or Brave. This is the primary mechanism used to render the screenshot sets. - [COMMAND_EXECUTION]: The skill's workflow instructions involve using the
magick(ImageMagick) command-line utility to extract color data from provided image files. - [EXTERNAL_DOWNLOADS]: The
assets/panorama.htmlfile includes a reference to Google Fonts to load the 'Inter' typeface. This is a well-known and trusted service used for asset delivery. - [DYNAMIC_EXECUTION]: The rendering scripts dynamically generate HTML wrapper files and temporary browser profiles in the system's temporary directory to facilitate the screenshot capture process.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of raw screenshots and reference sets provided by the user. The instructions mitigate potential manipulation by requiring the agent to maintain 'pixel-exact' UI reproduction and forbidding the use of AI to regenerate or alter text and interface elements from the original screenshots.
Audit Metadata