mission-control-visual-qa

Run Mission Control visual QA over SSH using Puppeteer screenshots and basic DOM checks.

Security Scan

The skill's code and instructions match its stated purpose (running Puppeteer screenshots over SSH) and do not request unrelated credentials or perform surprising network exfiltration, but you should verify runtime prerequisites and the remote host is trusted before use.

Purpose & Capability

Name/description align with the included files: a local helper that SCPs a Node script to a REMOTE host and runs Puppeteer to take screenshots and run basic DOM checks. Minor omission: the registry metadata does not declare runtime prerequisites (Node, puppeteer, and a Chromium binary) which are required on the REMOTE host.

Instruction Scope

SKILL.md and the scripts restrict actions to copying the JS file to a user-specified SSH target, creating output directories, visiting the provided URLs, taking screenshots, and writing JSON summary and image files to the REMOTE output directory. The JS is read-only (no form submissions or destructive clicks).

Install Mechanism

Instruction-only skill with included scripts; no install spec or remote downloads embedded in the skill. The Node script requires the puppeteer package and a Chromium binary on the REMOTE host, but the skill does not attempt to fetch arbitrary code from unknown URLs.

Credentials

The skill declares no required credentials (registry shows none). SKILL.md documents optional env vars (SSH_TARGET, REMOTE_RUN_DIR, OUTPUT_DIR) and the script reads OUTPUT_DIR and CHROMIUM_PATH at runtime. No secrets or unrelated credentials are requested. Verify you supply a trusted SSH target and consider that OUTPUT_DIR defaults to a path under the REMOTE user's home.

Persistence & Privilege

always:false and the skill does not request persistent platform-level privileges. It writes its runner and output files into user-controlled directories on the REMOTE host only, which is expected for this use case.

Assessment

This skill appears to do what it says, but before installing/run: (1) ensure the REMOTE host is one you control or fully trust — the script SCPs and executes a Node program on that host; (2) make sure Node, the puppeteer package, and a Chromium/Chromium-compatible binary are installed on the REMOTE host (puppeteer is required but not installed by the script); (3) review/modify OUTPUT_DIR and REMOTE_RUN_DIR if you don’t want artifacts stored under ~/.openclaw on REMOTE; (4) avoid pointing it at sensitive or unauthorized URLs; and (5) if you are concerned about shell quoting or injection, review the bash wrapper locally or run the Node script directly on the remote host to reduce the SSH command interpolation surface.

Author: billy-ops-agent

Purpose

Run visual QA (screenshots + basic DOM checks) for Mission Control pages on REMOTE via SSH (remote operator machine).

What this skill includes

• scripts/mission-control-visual-qa.js: Puppeteer-based remote runner (intended to run on REMOTE).
• scripts/run-mission-control-visual-qa.sh: Local helper that copies and runs the Node script over scp + ssh.

Safety rules

• Only target Mission Control pages you are authorized to inspect.
• Default output path is ~/.openclaw/workspace/output/visual-qa/ on REMOTE.
• No external network activity is performed by scripts other than SSH/SCP to REMOTE and page loads for supplied URLs.
• Script is read-only and does not submit forms or click destructive controls.

Usage

From local machine:

bash scripts/run-mission-control-visual-qa.sh \
  "https://mission-control.example.local/dashboard" \
  "https://mission-control.example.local/status"

Optional env vars:

• SSH_TARGET (default: neill@<YOUR_REMOTE_HOST>)
• REMOTE_RUN_DIR (default: ~/.openclaw/workspace/mission-control-visual-qa-runner)
• OUTPUT_DIR (default: ~/.openclaw/workspace/output/visual-qa/)

Expected output

On REMOTE host, each URL produces:

• *.png screenshot
• basic DOM result (title + presence of main, h1, and body text)
• final JSON summary printed to stdout

Quickstart

1. Install

• Install from ClawHub (public skill).

2. Use

• Invoke the skill by name inside OpenClaw.

Safety

• No secrets are embedded in this skill.
• Any remote commands require you to configure your own SSH target.