Skills visual-qa
📦
visual-qa
Content revision r1 Medium Risk 🌐 Network access📁 Filesystem access⚙️ External commands
Review Responsive Pages With Visual QA
Responsive websites can hide layout defects after animation changes. This skill captures scrolled full-page screenshots across device sizes for focused visual review.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "visual-qa" from https://skillstore.io/skills/crazyswami-visual-qa.md and its manifest at https://skillstore.io/api/skills/crazyswami-visual-qa/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "visual-qa". Run visual QA on the About page after the hero update.
Expected outcome:
Screenshots were captured across device sizes. The review found a desktop hero alignment issue and mobile spacing below the bio section.
Using "visual-qa". Check all configured pages before release.
Expected outcome:
- Home and About screenshots completed.
- Portfolio needs review because two images appear repeated.
- Contact and legal pages show no major layout issues.
Security Audit
Medium Riskv9 • 7/5/2026 Open versioned report
The skill performs legitimate visual QA with Playwright, but it has real network navigation and filesystem write behavior. Most static command and hidden-file findings are Markdown documentation false positives. Additional review should focus on broad tool permissions and default output paths outside the workspace.
2
Files scanned
353
Lines analyzed
10
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Broad Tool Permissions
The skill declares Read, Write, Edit, Bash, and Task permissions for a screenshot workflow. This expands agent authority beyond basic screenshot capture.
The allowed-tools line is explicit. Some permissions support the workflow, but Write and Edit are broader than needed for reviewing screenshots.
Medium
Default Output Outside Project Workspace
The screenshot script defaults to saving files under /root/screenshots. Marketplace users may expect outputs to stay inside the active workspace.
The default output path is directly assigned in the script. The same script later creates that directory and writes screenshots there.
Capability review items (10)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Python os file operations
os.makedirs(output_dir, exist_ok=True)
run_single_page creates the selected output directory before writing screenshots. This is legitimate functionality, but it is real filesystem write capability controlled by a CLI path.
Medium
Python os file operations
os.makedirs(output_dir, exist_ok=True)
run_all_pages creates the selected output directory before writing screenshots. This is expected for the skill, but still gives the script local write authority.
Low
Hardcoded URL
DEFAULT_BASE_URL = "https://local2.hustletogether.com"
DEFAULT_BASE_URL is used by --all mode, so the script can make outbound requests to a fixed host. The behavior is visible and related to visual QA, but it remains network access.
Low
Hardcoded URL
| Home | https://csrdevelopment.com/ |
The documentation lists this external site page as a target for visual QA. If followed, the skill performs outbound website requests.
Low
Hardcoded URL
| About | https://csrdevelopment.com/about/ |
The documentation lists this external site page as a target for visual QA. It is expected behavior, but it is still network access.
Low
Hardcoded URL
| Portfolio | https://csrdevelopment.com/portfolio/ |
The documentation lists this external site page as a target for visual QA. Following the skill can send browser requests to that host.
Low
Hardcoded URL
| Contact | https://csrdevelopment.com/contact/ |
The documentation lists this external site page as a target for visual QA. The target is transparent, but it remains outbound browsing.
Low
Hardcoded URL
| Privacy Policy | https://csrdevelopment.com/privacy-policy/ |
The documentation lists this external site page as a target for visual QA. It creates a real network dependency if the workflow is used.
Low
Hardcoded URL
| Terms | https://csrdevelopment.com/terms-of-service/ |
The documentation lists this external site page as a target for visual QA. The request target is explicit, but it is still network access.
Low
Hardcoded URL
python3 /root/.claude/skills/visual-qa/screenshot.py --url https://csrdevelopment.com/about/
The example command passes an external URL to the screenshot script. If executed, Playwright navigates to that external page.
Risk Factors
🌐 Network access (10)
📁 Filesystem access (6)
⚙️ External commands (7)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/crazyswami-visual-qa/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/crazyswami-visual-qa?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/crazyswami-visual-qa?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/crazyswami-visual-qa/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/crazyswami-visual-qa.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CrazySwami. (2026). visual-qa security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/crazyswami-visual-qa/audits/9BibTeX citation
@techreport{crazyswami-crazyswami-visual-qa-2026,
author = {CrazySwami},
title = {visual-qa security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/crazyswami-visual-qa/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "visual-qa security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "CrazySwami"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/crazyswami-visual-qa/audits/9"
identifiers:
- type: other
value: "skillstore:crazyswami-visual-qa:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Validate responsive layout changes
Capture screenshots for key pages and review animation, spacing, and overflow issues.
Review animated pages across devices
Generate consistent full-page captures to compare visual treatment on desktop, tablet, and mobile.
Collect release evidence
Create timestamped screenshots of important pages before a release or client review.
Try These Prompts
Check One Page
Run visual QA for this URL: {url}. Capture desktop, tablet, and mobile screenshots, then summarize visible layout issues.Review Configured Pages
Run visual QA on all configured pages for {base_url}. Note layout, image, form, and navigation issues by device size.Audit Animation Readiness
Check {url} after animation updates. Scroll before capture, then identify elements that remain hidden, cropped, or misaligned.Prepare Release QA Notes
Run a full visual QA pass for {base_url}. Group findings by severity and list screenshots that need human review.Best Practices
- Run the skill after layout, animation, template, or image changes.
- Use a workspace-relative output directory for each review.
- Review screenshots with the project requirements beside the checklist.
Avoid
- Running the default site targets when reviewing an unrelated project.
- Treating screenshots as a replacement for accessibility or interaction testing.
- Saving output into shared system directories or sensitive user folders.
Frequently Asked Questions
What does this skill test?
It captures responsive screenshots and supports manual review of layout, images, forms, navigation, and animation states.
Does it support custom URLs?
Yes. The screenshot script accepts a single URL and also supports a base URL for configured page paths.
Does it run visual diffs?
No. It captures screenshots for review but does not compare them against a stored baseline.
Why does it scroll before screenshots?
Scrolling helps trigger GSAP and ScrollTrigger animations before full-page screenshots are captured.
What setup is required?
The local environment needs Python, Playwright, and a Chromium browser installation.
Where are screenshots saved?
Screenshots are saved to a local output directory. Use a workspace-relative path for safer review workflows.
Developer Details
Author
CrazySwamiLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
02f077c174c5335e2f5d02ca15e77b70d9543e58
Maintenance freshness
7/18/2026
Usage
6 downloads · 173 views
File structure