Live Site Polish

ReviewAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent for polishing a live webpage, but users should notice that it controls a browser, runs page-local JavaScript, and may save or review screenshots of logged-in pages.

This skill is reasonable to use for browser-based website polish. Prefer staging sites or test accounts, confirm the design direction before edits, keep playwright-cli from a trusted installation, and review the saved screenshots and patch script before sharing or committing them.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may refuse to use other design or browser helpers while this skill is active.

Why it was flagged

The skill explicitly constrains tool and skill selection. This is disclosed and purpose-aligned with avoiding conflicting browser/design workflows, but users should know it changes how the agent chooses tools.

Skill content
Use $live-site-polish as the only design-related and browser-use-related skill... All browser interaction must go through playwright-cli only... Do not combine it with other skills... or invoke superpowers:brainstorming.
Recommendation

Use this skill when you want its single-tool workflow; if you need another browser/design tool, explicitly instruct the agent before starting.

What this means

The skill can modify what the current browser page displays and, if used on a logged-in page, the same mechanism has access to that page context.

Why it was flagged

The workflow uses playwright-cli run-code and page.evaluate to execute JavaScript inside the loaded page. This is central to temporary live-page redesign, and the guidance limits it to targeted static DOM/CSS changes.

Skill content
playwright-cli run-code "async page => { await page.evaluate(() => { const target = document.querySelector('[data-test=\"hero\"]'); ... target.style.maxWidth = '1200px'; }); }"
Recommendation

Use it on trusted or staging pages when possible, keep changes visual/static, and review generated patch scripts before applying them to real source code.

What this means

Screenshots, page inspection, and temporary browser edits may involve data visible in a logged-in account.

Why it was flagged

The skill may continue operating after the user completes login or MFA in a browser session. This is user-directed and expected for editing authenticated pages, but it can expose account-specific page content.

Skill content
If you hit login, MFA, CAPTCHA, or another manual checkpoint, switch to: playwright-cli open --headed ... Then ask the user to take over for that step and continue after they finish.
Recommendation

Only use authenticated sessions you are comfortable exposing to the agent, prefer test accounts or staging environments, and avoid pages with sensitive personal or financial data unless necessary.

What this means

A second agent/model context may see the page screenshots and brief used for review.

Why it was flagged

The visual-review workflow sends screenshots and task context to a separate reviewer context. The input is intentionally minimized, but screenshots can still contain sensitive page content.

Skill content
Provide only: task brief, page URL or short page identity, before screenshot, after screenshot, optional focused crop for the target area
Recommendation

Crop or redact sensitive information before review when possible, and use non-sensitive pages or test data for authenticated work.