Cn Web Screenshot

• Outcome: Pass
• Latest audit: Jun 7, 2026 at 3:56 AM UTC
• Version:
  1.0.2

Overview

This is a straightforward webpage screenshot tool that opens user-provided URLs and saves PNG files, with no evidence of hidden credential use, persistence, or exfiltration.

Install only if you want an agent to open URLs in a browser engine and save screenshots locally. Use explicit public HTTP/HTTPS targets, review any custom output path before running, and avoid private network, localhost, or authenticated pages unless that is your intended test.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are broad enough to match many ordinary requests about webpages or screenshots, which can cause the skill to activate unexpectedly. In this skill's context, unintended activation could lead to fetching attacker-controlled remote URLs and writing screenshot files locally without the user clearly consenting to those side effects.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The description does not warn that the skill will open remote URLs and save files locally, which hides important side effects from the user. In a web-fetching skill, this increases the risk of SSRF-like internal URL access, contacting malicious pages, or creating local artifacts without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.