visual-verify
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
child_process.spawnSyncto orchestrate multiple internal Node.js scripts (e.g.,image-diff.mjs,screenshot.mjs) during the verification workflow. It also executes a local shell script,ensure-chrome.sh, to manage the browser's lifecycle. These commands are restricted to the skill's own scripts and standard system binaries. - [DYNAMIC_EXECUTION]: The skill utilizes
Runtime.evaluatevia CDP to execute JavaScript directly within the browser tab. This is used for its core functionality: performing UI assertions, finding DOM elements, and simulating user interactions like clicks and form fills. The code executed is either hardcoded in the scripts or sourced from local checkpoint JSON files created during the development process. - [EXTERNAL_DOWNLOADS]: The skill relies on standard, well-known Node.js libraries (
sharpfor image processing andwsfor WebSocket communication) defined inpackage.json. It does not download or execute arbitrary code from remote servers at runtime.
Audit Metadata