Neomano Web Snapshot (Headless)

Take a screenshot (PNG) of any website in a headless way (no GUI) to verify it's rendering/working. Use when the user asks for a website screenshot, uptime v...

Security Scan

This skill's code and instructions are consistent with its stated purpose (headless website screenshots); it does not request secrets or reach out to unknown remote install hosts, but it will visit arbitrary URLs (including internal hosts) so use with caution.

Purpose & Capability

Name/description match the implementation: Playwright + Chromium is used to navigate and capture pages. The declared required binaries (node and bun) correspond to the scripts: bun is used for dependency/bootstrap and node runs the snapshot script. Requiring bun is unusual but justified by the bootstrap implementation.

Instruction Scope

SKILL.md only directs the agent to run the included bootstrap and snapshot scripts. The runtime navigates to arbitrary URLs provided by the caller — there are no instructions to read unrelated files or environment variables, nor to post data to external endpoints. However, because the skill will load arbitrary URLs, it can access internal services (localhost, intranet), fetch whatever content those pages serve, and capture it; that is expected behavior for a screenshot tool but is a privacy/SSRF risk to be aware of.

Install Mechanism

There is no registry install spec, but the bundled bootstrap.sh uses bun install and bunx playwright install chromium. Those commands install Playwright and download Chromium (Playwright's official installer), not a random archive from an unknown host. The install will write node_modules and browser binaries into the skill folder (disk writes and network downloads).

Credentials

The skill requests no environment variables or credentials. No secrets or unrelated service tokens are required.

Persistence & Privilege

The skill is not always:true, does not modify other skills or global agent config, and does not request elevated or persistent system privileges beyond installing local dependencies and browser binaries in its directory.

Assessment

This skill appears to be what it claims: a Playwright-based headless screenshot tool. Before installing, be aware that bootstrap.sh will download dependencies and a Chromium binary into the skill folder (disk and network activity). The runtime will visit any URL you supply — including internal hosts like localhost or intranet addresses — so avoid pointing it at sensitive internal services unless you intend that. If you have security concerns, run the bootstrap and snapshots in a sandboxed environment (container or VM), restrict which domains the agent may request, and verify bun/node are the intended tooling on your host.

One-time setup (headless)

This skill uses Playwright with headless Chromium (works without a GUI).

bash {baseDir}/scripts/bootstrap.sh

Note: node_modules/ is intentionally not shipped in the skill package; dependencies are installed locally by the bootstrap script.

Take a screenshot

bash {baseDir}/scripts/snapshot.sh "https://example.com" --out ./snapshots/example.png

Options:

• --full-page to capture full scroll height.
• --wait-ms 2000 to wait after load (useful for SPAs).