Skills visual-reviewer
📦

visual-reviewer

Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🌐 Network access

Review Visual Outputs Automatically

Visual issues are easy to miss when an AI creates pages, documents, or presentations. This skill captures previews, checks design details, and guides focused fixes.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "visual-reviewer" from https://skillstore.io/skills/barry-liu-888-visual-reviewer.md and its manifest at https://skillstore.io/api/skills/barry-liu-888-visual-reviewer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/barry-liu-888-visual-reviewer.md Signed manifest GET /api/skills/barry-liu-888-visual-reviewer/manifest Signed lockfile GET /api/skills/barry-liu-888-visual-reviewer/lockfile

Test it

Using "visual-reviewer". A generated dashboard page with tables and charts.

Expected outcome:

Findings: table headers wrap inconsistently, chart labels overlap, and primary button contrast is low. Suggested fixes: widen key columns, shorten chart labels, and darken button text.

Using "visual-reviewer". A presentation exported for client review.

Expected outcome:

Findings: title hierarchy is weak, slide margins vary, and one image is stretched. Suggested fixes: increase title size, normalize margins, and preserve image ratio.

Using "visual-reviewer". A mobile checkout view at narrow width.

Expected outcome:

Findings: the footer overlaps the total price, focus states are unclear, and long product names overflow. Suggested fixes: reserve footer space, restore focus rings, and wrap names.

Security Audit

High Risk
v4 • 7/6/2026 Open versioned report

The audit confirms real privacy and execution risks: the skill directs agents to run local screenshot scripts, capture windows or screen regions, start a local HTTP server, and collect process metadata. Many markdown backtick and entropy findings are false positives from documentation formatting and readable Chinese markdown. Because the workflow auto-triggers visual capture, publication should require confirmation, scoped capture, and safer local preview defaults.

5
Files scanned
849
Lines analyzed
6
Review items
0
False positives ignored

Confirmed security concerns (5)

High
scripts/capture_screenshot.py:253
Screen capture upload
"""Get screen coordinates for window capture."""
The function computes screen coordinates used by surrounding screenshot capture routines. I found no upload behavior, but local screen capture is privacy-sensitive, especially when paired with automatic review instructions.
High
SKILL.md:19-23SKILL.md:141-143
Automatic Screen Capture Without User Confirmation
SKILL.md instructs the skill to auto-trigger after visual outputs and says screenshot review must run without waiting for user instruction. That behavior can capture sensitive screen content unless confirmation and scope controls are required.
The instructions explicitly require automatic triggering and screenshot-first review. The included scripts implement window, region, active window, and fullscreen capture modes.
Medium
SKILL.md:42-43
Local Preview Server May Expose Files
SKILL.md tells the agent to run python -m http.server on port 8765 for an artifact directory without a bind address or access controls. The default server binding can expose served files beyond the intended local browser, depending on host firewall and network settings.
The command is directly documented without a localhost-only bind option. Exposure depends on the environment, so the confidence is high but not absolute.
Medium
scripts/capture_screenshot.py:212-217scripts/capture_screenshot.ps1:265-270
Debug Output Reveals Window and Process Names
When no matching window is found, both screenshot scripts print visible window lists with process names and titles. These names can reveal private applications, document names, or browser tabs.
The output statements directly build visible-window lists from local window metadata. I found no redaction before printing those names.
Low
scripts/capture_screenshot.py:106
System reconnaissance
pid = wintypes.DWORD()
The script reads window process IDs and process names to match target windows. That local metadata collection can reveal running applications and document titles.
Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
scripts/capture_screenshot.py:296
Python os file operations
os.makedirs(out_dir, exist_ok=True)
The script creates directories based on the user-supplied output path before writing screenshots. This is intended behavior, but unrestricted filesystem writes should be constrained to the workspace or a temporary directory.
Medium
SKILL.md:32-37
Ruby/shell backtick execution
```bash
This markdown block instructs the agent to run a local Python screenshot script. External command execution is real and can capture UI content from the desktop.
Medium
SKILL.md:42-43
Ruby/shell backtick execution
1. 启动本地 HTTP 服务器:`python -m http.server 8765 -d <产物目录>`
The skill explicitly instructs running python -m http.server for a generated artifact directory. Starting a local server is external command execution and can expose files if not bound safely.
Medium
SKILL.md:45-49
Ruby/shell backtick execution
```bash
The markdown block directs the agent to run the Python screenshot script against browser processes. That is real external command execution with screen capture impact.
Medium
SKILL.md:55-61
Ruby/shell backtick execution
```bash
This code block instructs running the Python screenshot script for document and application windows. The command can execute local code and collect visual content.
Medium
SKILL.md:66-68
Ruby/shell backtick execution
```bash
This block instructs running the Python screenshot script in region mode. It is legitimate for the skill, but still external command execution with screen capture scope.

Risk Factors

⚙️ External commands (32)
scripts/capture_screenshot.ps1:268 scripts/capture_screenshot.ps1:276 scripts/capture_screenshot.ps1:279 scripts/capture_screenshot.ps1:32 scripts/capture_screenshot.ps1:33 scripts/capture_screenshot.ps1:34 scripts/capture_screenshot.py:4 SKILL.md:30 SKILL.md:32-37 SKILL.md:37-39 SKILL.md:39 SKILL.md:42-43 SKILL.md:43-45 SKILL.md:45-49 SKILL.md:49-53 SKILL.md:53-55 SKILL.md:55-61 SKILL.md:61-66 SKILL.md:66-68 SKILL.md:68-74 SKILL.md:74 SKILL.md:75 SKILL.md:76 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:81-83 SKILL.md:83 SKILL.md:91-92 SKILL.md:92-114 SKILL.md:114-125 SKILL.md:125-137
📁 Filesystem access (1)
scripts/capture_screenshot.py:296
🌐 Network access (1)
SKILL.md:43

Detected Patterns

Screen capture uploadSystem reconnaissance
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/barry-liu-888-visual-reviewer/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/barry-liu-888-visual-reviewer/security.svg)](https://skillstore.io/skills/barry-liu-888-visual-reviewer?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/barry-liu-888-visual-reviewer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/barry-liu-888-visual-reviewer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/barry-liu-888-visual-reviewer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

Barry-Liu-888. (2026). visual-reviewer security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/barry-liu-888-visual-reviewer/audits/4

BibTeX citation

@techreport{barry-liu-888-barry-liu-888-visual-reviewer-2026, author = {Barry-Liu-888}, title = {visual-reviewer security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/barry-liu-888-visual-reviewer/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "visual-reviewer security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "Barry-Liu-888" date-released: "2026-07-06" url: "https://skillstore.io/skills/barry-liu-888-visual-reviewer/audits/4" identifiers: - type: other value: "skillstore:barry-liu-888-visual-reviewer:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
64
Architecture
85
Maintainability
87
Content
67
Community
83
Spec Compliance

What You Can Build

Validate Generated UI

Catch layout, spacing, and responsive defects after AI-assisted UI changes.

Review Client Documents

Inspect exported documents or presentations for typography, spacing, and color issues before delivery.

Check Internal Dashboards

Verify tables, charts, empty states, and loading states in internal tools.

Try These Prompts

Review a Page 
Open the generated HTML page, capture the target preview window, and report visible layout, spacing, typography, and color issues.
Fix Visual Defects 
Review the current UI screenshot, identify the top three visible defects, apply safe style fixes, and re-check the result.
Compare Responsive States 
Capture the page at mobile, tablet, and desktop widths. Compare alignment, overflow, touch targets, and readable hierarchy.
Audit a Complex Workflow 
Review the dashboard through normal, loading, empty, error, and long-content states. Fix visual defects and summarize remaining risks.

Best Practices

  • Capture only the target artifact window whenever possible.
  • Review the screenshot before changing code, then verify again after each fix.
  • Keep visual fixes scoped to layout, style, and presentation unless the user asks otherwise.

Avoid

  • Do not use fullscreen capture when a window or region capture is enough.
  • Do not serve broad project directories over a local HTTP server.
  • Do not change business logic while fixing visual presentation issues.

Frequently Asked Questions

Does this skill write code changes?
It can guide style and layout fixes when the host agent has file-editing tools.
Does it need screenshots?
Yes. Its workflow relies on screenshots instead of code-only judgment.
Which artifacts can it review?
It targets web pages, documents, presentations, dashboards, and other visible outputs.
Can it run on macOS or Linux?
The included capture scripts use Windows APIs. Other platforms need different capture tooling.
Can it replace accessibility testing?
No. It can notice visual contrast and focus issues, but dedicated accessibility testing is still needed.
Is fullscreen capture safe?
Fullscreen capture can include private content. Prefer named window or region capture.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/Barry-Liu-888/ai-skills/tree/master/visual-reviewer

Ref

c4231f0153ccd2a2ed62274c5a372bf8f2386d3f

Maintenance freshness

7/18/2026

Usage

3 downloads · 12 views

File structure

📁 references/

📄 visual_checklist.md

📁 scripts/

📄 capture_screenshot.ps1

📄 capture_screenshot.py

📄 requirements.txt

📄 SKILL.md