visual-debug
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several Bash scripts to automate the visual debugging process. These scripts invoke standard utilities such as
imagemagickfor pixel comparisons,ffmpegfor frame extraction from videos, anddssimfor structural similarity checks. These operations are restricted to the local environment and are necessary for the skill's stated purpose. - [DATA_EXFILTRATION]: While the skill opens external URLs via browser automation and captures screenshots, this is its primary function. The documentation explicitly identifies the risk of capturing sensitive data (PII or auth tokens) that might be visible on the pages and provides instructions for cleaning up temporary files (
tmp/ref/) to mitigate this risk. - [DYNAMIC_EXECUTION]: The scripts
computed-diff.shandlayout-health-check.shuse local Python and Node.js interpreters to process JSON data extracted from the browser. This is a standard method for handling complex data structures in shell environments and does not involve executing untrusted remote code. - [PROMPT_INJECTION]: The instructions focus entirely on the technical task of visual comparison and do not contain patterns typical of prompt injection or attempts to bypass AI safety guidelines.
Audit Metadata