screenshot-capture — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited screenshot-capture (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Capture clean, consistent screenshots from a running app and drop them straight into the docs — then regenerate them in one command when the UI changes. This is the visual half of the documentation + release pack: user-guide-builder writes [SCREENSHOT: id] markers; this skill fills them with real images.
The point is repeatability. Hand-grabbed screenshots rot the moment a button moves. A config-driven shot list is re-run per release, so the guide's pictures always match the product.
user-guide-builder → writes the guide + [SCREENSHOT: id] markers
screenshot-capture → captures images, fills the markers ← you are here
shipping-log → can reuse the same shots as feature art
all three are versioned together via docs/VERSION| App type | Use | Why |
|---|---|---|
| Web app (Next.js, Vite, etc.) | Playwright via scripts/capture.mjs (default) | Deterministic, sized, re-runnable, can log in, redact, annotate |
| Web app, quick one-off | Claude Preview MCP (preview_start → preview_screenshot) | No script/config; good for a single shot |
| Native / desktop app | computer-use (screenshot + window control) | Only path that can drive a non-browser UI |
The bundled script targets the common case (web apps). The rest of this skill describes it.
1. Make sure the app is running (its dev command, or the `run` skill). Note the URL/port.
2. Copy assets/screenshots.config.example.json → docs/screenshots.config.json and edit it.
3. node <skill-dir>/scripts/capture.mjs --dry-run ← plan + gap report, no browser
4. Install Playwright if needed: npm i -D playwright && npx playwright install chromium
5. node <skill-dir>/scripts/capture.mjs ← capture every shot
6. node <skill-dir>/scripts/capture.mjs --fill-markers ← embed images into the guide--dry-run is the safe first step: it parses the guide's [SCREENSHOT: …] markers, lists the shots you've configured, and reports orphan markers (no shot yet) and unused shots (no marker) — so you know exactly what's missing before launching a browser.
docs/screenshots.config.json (full schema + recipes in references/capture-recipes.md):
{
"baseUrl": "http://localhost:3000",
"outDir": "docs/user-guide/screenshots",
"viewport": { "width": 1440, "height": 900 },
"guide": "docs/user-guide/MyFieldTime-User-Guide.md",
"vars": { "projectId": "demo-project-id" }, // {projectId} in any url
"auth": {
"loginUrl": "/login",
"steps": [
{ "fill": "#email", "value": "[email protected]" },
{ "fill": "#password", "env": "SHOT_PASS" }, // creds from env, not committed
{ "click": "button[type=submit]" },
{ "waitFor": "/dashboard" }
]
},
"shots": [
{ "id": "dashboard", "label": "Company dashboard", "url": "/dashboard", "waitFor": ".project-card" },
{ "id": "calendar", "label": "Calendar", "url": "/project/{projectId}/calendar", "fullPage": true },
{ "id": "co-approve","label": "Change order approval", "url": "/project/{projectId}/change-orders",
"highlight": ".approve-btn", "mask": [".homeowner-email"] }
]
}Per-shot options: url · selector (capture one element) · clip · fullPage · waitFor (selector) · wait (ms) · highlight (outline + scroll to an element) · mask (selectors painted over — native Playwright redaction).
painted out in the capture, not just cropped.
Standardize on short ids: [SCREENSHOT: dashboard], [SCREENSHOT: co-approve]. The --fill-markers step matches a marker to a shot by id or label, then replaces it with . Re-running re-captures the PNG in place, so the embed stays valid — refresh is one command.
"env": "SHOT_PASS"), never hard-coded in a committed config.mask option — assume screenshots get shared publicly.screenshots.config.json free of secrets.This skill is project-agnostic: the config carries everything app-specific (URL, login, routes). The same capture.mjs serves MyFieldTime, LogNog, Directors Palette, or any web app — only the config changes. For a non-web app, fall back to computer-use.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.