技能 visual-reviewer
📦

visual-reviewer

内容修订 r1 高风险 ⚙️ 外部命令📁 文件系统访问🌐 网络访问

自动审查视觉输出

当 AI 创建页面、文档或演示文稿时，视觉问题很容易被忽略。此技能会捕获预览、检查设计细节，并指导有针对性的修复。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "visual-reviewer" from https://skillstore.io/skills/barry-liu-888-visual-reviewer.md and its manifest at https://skillstore.io/api/skills/barry-liu-888-visual-reviewer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/barry-liu-888-visual-reviewer.md 已签名 manifest GET /api/skills/barry-liu-888-visual-reviewer/manifest 已签名 lockfile GET /api/skills/barry-liu-888-visual-reviewer/lockfile

测试它

正在使用“visual-reviewer”。 包含表格和图表的生成式仪表板页面。

预期结果:

发现：表头换行不一致，图表标签重叠，主按钮对比度较低。建议修复：加宽关键列，缩短图表标签，并加深按钮文字颜色。

正在使用“visual-reviewer”。 导出供客户审查的演示文稿。

预期结果:

发现：标题层级较弱，幻灯片边距不一致，并且有一张图片被拉伸。建议修复：增大标题字号，统一边距，并保持图片比例。

正在使用“visual-reviewer”。 窄宽度下的移动端结账视图。

预期结果:

发现：页脚与总价重叠，焦点状态不清晰，长商品名称溢出。建议修复：为页脚预留空间，恢复焦点环，并让名称换行。

安全审计

高风险
v4 • 2026/7/6 打开版本化报告

The audit confirms real privacy and execution risks: the skill directs agents to run local screenshot scripts, capture windows or screen regions, start a local HTTP server, and collect process metadata. Many markdown backtick and entropy findings are false positives from documentation formatting and readable Chinese markdown. Because the workflow auto-triggers visual capture, publication should require confirmation, scoped capture, and safer local preview defaults.

5
已扫描文件
849
分析行数
6
复核项
0
已忽略误报

已确认安全问题 (5)

高
scripts/capture_screenshot.py:253
Screen capture upload
"""Get screen coordinates for window capture."""
The function computes screen coordinates used by surrounding screenshot capture routines. I found no upload behavior, but local screen capture is privacy-sensitive, especially when paired with automatic review instructions.
高
SKILL.md:19-23SKILL.md:141-143
Automatic Screen Capture Without User Confirmation
SKILL.md instructs the skill to auto-trigger after visual outputs and says screenshot review must run without waiting for user instruction. That behavior can capture sensitive screen content unless confirmation and scope controls are required.
The instructions explicitly require automatic triggering and screenshot-first review. The included scripts implement window, region, active window, and fullscreen capture modes.
中
SKILL.md:42-43
Local Preview Server May Expose Files
SKILL.md tells the agent to run python -m http.server on port 8765 for an artifact directory without a bind address or access controls. The default server binding can expose served files beyond the intended local browser, depending on host firewall and network settings.
The command is directly documented without a localhost-only bind option. Exposure depends on the environment, so the confidence is high but not absolute.
中
scripts/capture_screenshot.py:212-217scripts/capture_screenshot.ps1:265-270
Debug Output Reveals Window and Process Names
When no matching window is found, both screenshot scripts print visible window lists with process names and titles. These names can reveal private applications, document names, or browser tabs.
The output statements directly build visible-window lists from local window metadata. I found no redaction before printing those names.
低
scripts/capture_screenshot.py:106
System reconnaissance
pid = wintypes.DWORD()
The script reads window process IDs and process names to match target windows. That local metadata collection can reveal running applications and document titles.
能力复核项 (6)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中
scripts/capture_screenshot.py:296
Python os file operations
os.makedirs(out_dir, exist_ok=True)
The script creates directories based on the user-supplied output path before writing screenshots. This is intended behavior, but unrestricted filesystem writes should be constrained to the workspace or a temporary directory.
中
SKILL.md:32-37
Ruby/shell backtick execution
```bash
This markdown block instructs the agent to run a local Python screenshot script. External command execution is real and can capture UI content from the desktop.
中
SKILL.md:42-43
Ruby/shell backtick execution
1. 启动本地 HTTP 服务器:`python -m http.server 8765 -d <产物目录>`
The skill explicitly instructs running python -m http.server for a generated artifact directory. Starting a local server is external command execution and can expose files if not bound safely.
中
SKILL.md:45-49
Ruby/shell backtick execution
```bash
The markdown block directs the agent to run the Python screenshot script against browser processes. That is real external command execution with screen capture impact.
中
SKILL.md:55-61
Ruby/shell backtick execution
```bash
This code block instructs running the Python screenshot script for document and application windows. The command can execute local code and collect visual content.
中
SKILL.md:66-68
Ruby/shell backtick execution
```bash
This block instructs running the Python screenshot script in region mode. It is legitimate for the skill, but still external command execution with screen capture scope.

风险因素

⚙️ 外部命令 (32)
scripts/capture_screenshot.ps1:268 scripts/capture_screenshot.ps1:276 scripts/capture_screenshot.ps1:279 scripts/capture_screenshot.ps1:32 scripts/capture_screenshot.ps1:33 scripts/capture_screenshot.ps1:34 scripts/capture_screenshot.py:4 SKILL.md:30 SKILL.md:32-37 SKILL.md:37-39 SKILL.md:39 SKILL.md:42-43 SKILL.md:43-45 SKILL.md:45-49 SKILL.md:49-53 SKILL.md:53-55 SKILL.md:55-61 SKILL.md:61-66 SKILL.md:66-68 SKILL.md:68-74 SKILL.md:74 SKILL.md:75 SKILL.md:76 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:81-83 SKILL.md:83 SKILL.md:91-92 SKILL.md:92-114 SKILL.md:114-125 SKILL.md:125-137
📁 文件系统访问 (1)
scripts/capture_screenshot.py:296
🌐 网络访问 (1)
SKILL.md:43

检测到的模式

Screen capture uploadSystem reconnaissance
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/barry-liu-888-visual-reviewer/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/barry-liu-888-visual-reviewer/security.svg)](https://skillstore.io/skills/barry-liu-888-visual-reviewer?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/barry-liu-888-visual-reviewer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/barry-liu-888-visual-reviewer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/barry-liu-888-visual-reviewer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

Barry-Liu-888. (2026). visual-reviewer security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/barry-liu-888-visual-reviewer/audits/4

BibTeX 引用

@techreport{barry-liu-888-barry-liu-888-visual-reviewer-2026, author = {Barry-Liu-888}, title = {visual-reviewer security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/barry-liu-888-visual-reviewer/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "visual-reviewer security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "Barry-Liu-888" date-released: "2026-07-06" url: "https://skillstore.io/skills/barry-liu-888-visual-reviewer/audits/4" identifiers: - type: other value: "skillstore:barry-liu-888-visual-reviewer:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
64
架构
85
可维护性
87
内容
67
社区
83
规范符合性

你能构建什么

验证生成的 UI

在 AI 辅助的 UI 变更之后，发现布局、间距和响应式缺陷。

审查客户文档

在交付前检查导出的文档或演示文稿是否存在排版、间距和颜色问题。

检查内部仪表板

验证内部工具中的表格、图表、空状态和加载状态。

试试这些提示

审查页面 
打开生成的 HTML 页面，捕获目标预览窗口，并报告可见的布局、间距、排版和颜色问题。
修复视觉缺陷 
审查当前 UI 截图，识别前三个可见缺陷，应用安全的样式修复，并重新检查结果。
比较响应式状态 
在移动端、平板和桌面宽度下捕获页面。比较对齐、溢出、触控目标和可读层级。
审计复杂工作流 
在正常、加载、空、错误和长内容状态下审查仪表板。修复视觉缺陷并总结剩余风险。

最佳实践

  • 尽可能只捕获目标产物窗口。
  • 在更改代码前先审查截图，然后在每次修复后再次验证。
  • 除非用户另有要求，否则将视觉修复限定在布局、样式和呈现范围内。

避免

  • 当窗口或区域捕获已经足够时，不要使用全屏捕获。
  • 不要通过本地 HTTP 服务器提供范围过大的项目目录。
  • 修复视觉呈现问题时，不要更改业务逻辑。

常见问题

这个技能会编写代码变更吗？
当宿主智能体具备文件编辑工具时，它可以指导样式和布局修复。
它需要截图吗？
是。它的工作流依赖截图，而不是仅凭代码判断。
它可以审查哪些产物？
它面向网页、文档、演示文稿、仪表板和其他可见输出。
它可以在 macOS 或 Linux 上运行吗？
包含的捕获脚本使用 Windows API。其他平台需要不同的捕获工具。
它可以替代无障碍测试吗？
不能。它可以发现视觉对比度和焦点问题，但仍然需要专门的无障碍测试。
全屏捕获安全吗？
全屏捕获可能包含私密内容。优先使用命名窗口或区域捕获。

开发者详情

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/Barry-Liu-888/ai-skills/tree/master/visual-reviewer

引用

c4231f0153ccd2a2ed62274c5a372bf8f2386d3f

维护新鲜度

2026/7/18

使用量

3 次下载 · 12 次浏览

文件结构

📁 references/

📄 visual_checklist.md

📁 scripts/

📄 capture_screenshot.ps1

📄 capture_screenshot.py

📄 requirements.txt

📄 SKILL.md

Barry-Liu-888 的更多技能

查看全部

相关技能

查看全部