browser-screenshot — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited browser-screenshot (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Capture screenshots of the web application for visual verification during UI/CSS iteration.
No project setup or link is needed. The project must already have Node.js, the playwright package in a node_modules reachable from its dependency directory, and a matching Chromium. Never install packages or browsers from this skill; when the helper reports them missing, hand the user its command (npm install playwright && npx playwright install chromium) to run themselves. Existing project scripts/screenshot links keep working; leave them alone.
The canonical helper is ~/.agents/skills/browser-screenshot/scripts/screenshot.sh. Only when it is absent or SKILLS_DIR is set, resolve and validate the installed root read-only first. A nonempty absolute SKILLS_DIR is authoritative; never replace an invalid override silently. Otherwise prefer the canonical root, falling back to the Claude alias root only when this skill unit is absent. Legacy Codex-only roots require explicit SKILLS_DIR.
set -eu
if [[ -z "${SKILLS_DIR:-}" ]]; then
SKILLS_DIR="$HOME/.agents/skills"
if [[ ! -d "$SKILLS_DIR/browser-screenshot" ]]; then
SKILLS_DIR="${CLAUDE_SKILLS_DIR:-${CLAUDE_HOME:-$HOME/.claude}/skills}"
fi
fi
[[ "$SKILLS_DIR" = /* ]] || { echo "SKILLS_DIR must be absolute" >&2; exit 1; }
for resource in SKILL.md scripts/screenshot.sh; do
[[ -f "$SKILLS_DIR/browser-screenshot/$resource" && -r "$SKILLS_DIR/browser-screenshot/$resource" ]] || {
echo "Missing browser-screenshot resource: $resource" >&2; exit 1;
}
done
[[ -x "$SKILLS_DIR/browser-screenshot/scripts/screenshot.sh" ]] || { echo "screenshot.sh is not executable" >&2; exit 1; }Missing resources stop the run; do not repair the installation. Reuse the verified absolute path in later tool calls, since shell variables may not persist between them.
/browser-screenshot
/browser-screenshot http://localhost:3000
/browser-screenshot http://localhost:3000 mobile$ARGUMENTS contains a URL, use itSCREENSHOT_URL env var if sethttp://localhost:3000$ARGUMENTS contains mobile, use mobile viewport (375x812)$ARGUMENTS contains tablet, use tablet viewport (768x1024)$ARGUMENTS contains a custom size like 1024x768, use those dimensions$ARGUMENTS contains both, take two screenshots (desktop and mobile)node_modules contains Playwright with -C (for example a nested web app). Omit -C when the current directory already resolves it; parent node_modules directories also count. Quote paths containing spaces, and never prefix the call with cd … &&.
~/.agents/skills/browser-screenshot/scripts/screenshot.sh -C web <url> <viewport>With an override or fallback root, use its verified absolute path instead: "<verified-root>/browser-screenshot/scripts/screenshot.sh" -C "<dependency dir>" <url> <viewport>. A relative output path (third argument) stays relative to the invocation directory.
Permissions: the frontmatter grant is Claude Code metadata matching the canonical ~/.agents/... prefix, the convention other skills use; exact matching of an expanded or override path is not verified, so expect a prompt there. Pi does not enforce allowed-tools, and Codex applies its own sandbox and approval policy. Report any prompt rather than widening permissions.
Screenshots are saved to a fresh private directory (mode 0700) created per run, unless you pass an explicit output path as the third argument. The script prints the full path it wrote — read it from the output rather than assuming a location. Screenshots may capture authenticated pages, which is why the directory is not a predictable shared one.
waitUntil: 'networkidle' with a 15s timeout — if the page loads async content, the screenshot will wait for it./browser-screenshot to verify, repeat.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.