Website Screenshot Tool

• Outcome: Pass
• Latest audit: May 28, 2026 · 9:32 AM UTC
• Version: 1.0.0

Overview

This is a straightforward website screenshot tool; its browser automation and file output match its stated purpose, though dependencies should be pinned before serious use.

Install it only where automated browser visits to the URLs you provide are acceptable, especially if the runtime can reach private/internal sites. For production or CI, pin dependencies with a lockfile and run browser automation in an isolated environment with a dedicated output directory.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
selenium>=4.15.0
pytest>=7.0.0

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower bound only, which allows future versions to be installed without review. This weakens build reproducibility and can introduce breaking changes or newly published malicious/compromised releases through the supply chain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
selenium>=4.15.0
pytest>=7.0.0

• Confidence: 98% confidence
• Finding: The selenium dependency is unpinned and also has known advisories affecting versions below fixed releases. Because the requirement allows installation of vulnerable versions such as 4.15.0 and later within the range semantics, this can expose the tool to dependency-level issues and makes builds non-reproducible.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
selenium>=4.15.0
pytest>=7.0.0

• Confidence: 91% confidence
• Finding: Using pytest with only a minimum version permits uncontrolled upgrades and non-reproducible environments. Even for a test dependency, vulnerable or incompatible versions can affect CI pipelines and developer environments.

Known Vulnerable Dependency: selenium — 2 advisory(ies): CVE-2022-28108 (Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content ); CVE-2023-5590 (NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.)

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The requirement for selenium may resolve to versions impacted by published advisories, including older vulnerable releases below 4.14 and server-side Grid issues in affected versions. In a website screenshot automation tool, browser automation components may be exposed in CI, containers, or internal services, which increases practical risk if Selenium Grid or related components are used.

Known Vulnerable Dependency: pytest — 1 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling)

Low

• Category: Supply Chain
• Confidence: 65% confidence
• Finding: The pytest advisory indicates vulnerable tmpdir handling in affected versions. Although pytest is typically a development/test dependency rather than production runtime code, it can still affect CI workers and developer systems if untrusted tests or artifacts are processed.

Static analysis

No suspicious patterns detected.