visual-verify

Pass

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses child_process.spawnSync to orchestrate multiple internal Node.js scripts (e.g., image-diff.mjs, screenshot.mjs) during the verification workflow. It also executes a local shell script, ensure-chrome.sh, to manage the browser's lifecycle. These commands are restricted to the skill's own scripts and standard system binaries.
  • [DYNAMIC_EXECUTION]: The skill utilizes Runtime.evaluate via CDP to execute JavaScript directly within the browser tab. This is used for its core functionality: performing UI assertions, finding DOM elements, and simulating user interactions like clicks and form fills. The code executed is either hardcoded in the scripts or sourced from local checkpoint JSON files created during the development process.
  • [EXTERNAL_DOWNLOADS]: The skill relies on standard, well-known Node.js libraries (sharp for image processing and ws for WebSocket communication) defined in package.json. It does not download or execute arbitrary code from remote servers at runtime.
Audit Metadata
Risk Level
SAFE
Analyzed
May 13, 2026, 12:05 PM