URL to PNG

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is coherent for turning a URL into a mobile-sized PNG, but it does install and run third-party screenshot tooling through uv.

Before installing, be aware that the skill uses uvx to install/run shot-scraper and Chromium. If you trust that tooling, the behavior appears purpose-aligned: it renders the URL, saves a PNG, and returns the file.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may download and install external screenshot/browser components on the local machine.

Why it was flagged

The installer fetches and installs third-party shot-scraper/Chromium tooling through uvx. This is disclosed and purpose-aligned, but it means installation depends on external package/browser provenance and updates.

Skill content

uvx shot-scraper install --browser chromium

Recommendation

Install only if you are comfortable trusting the shot-scraper/Chromium toolchain; maintainers could improve assurance by pinning versions or documenting package provenance.

Info

#ASI05: Unexpected Code Execution

What this means

Using the skill will contact the requested URL, render it with Chromium-based tooling, and create a PNG file locally.

Why it was flagged

The runtime behavior is a local shell script invoking browser-based screenshot tooling against the supplied URL. This is expected for the skill, but users should know it executes local CLI/browser automation.

Skill content

uvx shot-scraper shot "${url}" \
    --browser chromium \
    --width 390

Recommendation

Use it for URLs you intentionally want rendered and saved, and verify the output location when providing a custom path.