Is visual-regression safe to install?

SaferSkills independently audited visual-regression (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.claude/skills/visual-regression/SKILL.md · 1 file

.claude/skills/visual-regression/SKILL.md4.7 KB · Markdown

name: visual-regression

description: |

Standalone visual regression guard using before/after screenshot comparison. Two modes: SIT (compare staging vs local dev)

or Local (compare git-stashed base vs current changes). No long-lived baselines — captures fresh screenshots

each run and deletes after comparison. Config-driven from workspace-config.yaml.

Use when: "跑 visual regression", "檢查畫面", "頁面有沒有壞", "visual test", "screenshot test",

"畫面測試", "截圖比對", "有沒有跑版", "畫面壞了嗎", "UI 有沒有問題", "check if pages look right",

for standalone manual investigation.

要用截圖前後比對確認畫面沒跑版。例如「跑 visual regression」「檢查畫面」

「有沒有跑版」「畫面壞了嗎」。

不用於：單元測試（那是「這一類工作怎麼算 done」的一部分，走 swe-knowledge）、

效能或 Core Web Vitals（走該公司自己的 CWV 調查 skill）。

metadata:

requires:

- skill: driving-work-to-done

why: VR 產出住在單的目錄裡，而那個目錄會被它的 place-issues-by-state.sh 依狀態搬走；不知道這件事的人會手動擺放，下一次重算就把它們搬丟

scope: universal

tools:

- name: PyYAML

why: 讀 workspace-config.yaml 與 SKILL.md 的 frontmatter

provision: framework

probe: ${PYTHON_BIN:-python3} -c "import yaml"

install: uv

- name: pnpm

provision: framework

why: 跑 toolchain package 與產品 repo 的指令

- name: playwright

provision: framework

why: 截圖比對要一顆瀏覽器

install: pnpm:.claude/skills/visual-regression/toolchain

Visual Regression

Before/after screenshot comparison guard。每次執行都抓 fresh before / after screenshots，使用 Playwright diff，分析後刪除 temporary snapshots 與 test results；不維護 long-lived baselines。

Contract

VR 的測試單位是 domain，不是 repo。頁面由 configured URL paths 定義；不可因「頁面不在目前 repo」而 skip。合法 skip 僅限 config 缺漏、dependency declined、clean local tree、 smart-skip 判斷無 visual impact、fixture 未建立、已知 SSR hang、環境依賴缺失。

VR 在 quality chain 中回答：「既有頁面是否仍 visually intact？」它不取代 Local CI Mirror，也不取代 feature behavior verification。

Reference Loading

依執行情境讀取：

Situation	Load
Any VR run	`visual-regression-principles.md`, `visual-regression-preflight-flow.md`, `visual-regression-config.md`, `workspace-config.yaml`
Screenshot execution	`visual-regression-capture-flow.md`, `dependency-consent.md`
Fixtures enabled	`api-contract-guard.md`, `visual-regression-fixture-flow.md`, `vr-artifact-location.md`
Analysis or JIRA report	`visual-regression-analysis-reporting.md`

JIRA report、Slack summary，或任何 external write body 送出前，必須依 workspace-config.yaml 的 language 驗證語言。

Flow

解析 domain 與 company config，套用 root defaults inheritance。
檢查 visual regression 是否已設定；未設定則 stop，不 improvisation。
執行 smart skip、dependency consent、Playwright/toolchain readiness。
決定 SIT 或 Local comparison path；SIT 不可達時依 reference fallback。
透過 polaris-env.sh 啟動 production-equivalent proxy 與 dev environment。
Fixtures active 時先跑 API contract guard。
Capture before screenshots，capture after screenshots，讓 Playwright compare。
分析結果、套用 first-run quality gate、必要時上傳 artifacts 並寫 JIRA wiki report。
無論 pass/fail/error 都 cleanup，保護 git stash、server state、temporary snapshots。

Hard Rules

Always go through production-equivalent proxy；不可直接打 app dev port 迴避 routing。
CSR content 必須等 deterministic selector，不使用 fixed timeout 當 readiness。
UA-based mobile SSR 必須設定 mobile user agent，不只設 viewport。
Fixtures active 時為 strict mode：任何 diff 都不是 data variance。
First run after fixture setup/change 必須 human screenshot review；zero-diff 不代表截圖正確。
Playwright tests 必須 sequential，workers: 1。
JIRA inline screenshot report 使用 REST API v2 wiki markup，不使用 MCP markdown comment。

Completion

Standalone run 回報 domain、comparison path、pages count、diff summary、HTML report path、 cleanup status。

Post-Task Reflection (required)

若本次修改 config、fixtures、JIRA report、或 framework references，final response 前執行

visual-regression— agent skill

Is visual-regression safe to install?

Visual Regression

Contract

Reference Loading

Flow

Hard Rules

Completion

Post-Task Reflection (required)

Audit the pieces. Scan the whole. Decide.