external/trailofbits-skills-curated/plugins/openai-screenshot/skills/openai-screenshot/SKILL.md
Use when the user explicitly asks for a desktop or system screenshot (full screen, specific app or window, or a pixel region), or when tool-specific capture capabilities are unavailable and an OS-level capture is needed. Originally from OpenAI's curated skills catalog.
npx skillsauth add seikaikyo/dash-skills openai-screenshotInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Follow these save-location rules every time:
On macOS, run the preflight helper once before window/app capture. It checks Screen Recording permission, explains why it is needed, and requests it in one place.
The helpers route Swift's module cache to $TMPDIR/codex-swift-module-cache
to avoid extra sandbox module-cache prompts.
bash {baseDir}/scripts/ensure_macos_permissions.sh
To avoid multiple sandbox approval prompts, combine preflight + capture in one command when possible:
bash {baseDir}/scripts/ensure_macos_permissions.sh && \
python3 {baseDir}/scripts/take_screenshot.py --app "the agent"
For the agent inspection runs, keep the output in temp:
bash {baseDir}/scripts/ensure_macos_permissions.sh && \
python3 {baseDir}/scripts/take_screenshot.py --app "<App>" --mode temp
Use the bundled scripts to avoid re-deriving OS-specific commands.
Run the helper from the repo root:
python3 {baseDir}/scripts/take_screenshot.py
Common patterns:
python3 {baseDir}/scripts/take_screenshot.py
python3 {baseDir}/scripts/take_screenshot.py --mode temp
python3 {baseDir}/scripts/take_screenshot.py --path output/screen.png
python3 {baseDir}/scripts/take_screenshot.py --app "the agent"
python3 {baseDir}/scripts/take_screenshot.py --app "the agent" --window-name "Settings"
python3 {baseDir}/scripts/take_screenshot.py --list-windows --app "the agent"
python3 {baseDir}/scripts/take_screenshot.py --mode temp --region 100,200,800,600
--app to capture all windows):python3 {baseDir}/scripts/take_screenshot.py --mode temp --active-window
python3 {baseDir}/scripts/take_screenshot.py --window-id 12345
The script prints one path per capture. When multiple windows or displays match, it prints multiple paths (one per line) and adds suffixes like -w<windowId> or -d<display>. View each path sequentially with the image viewer tool, and only manipulate images if needed or requested.
bash {baseDir}/scripts/ensure_macos_permissions.sh && \
python3 {baseDir}/scripts/take_screenshot.py --app "<App>" --mode temp
--region to isolate a single display when needed.The helper automatically selects the first available tool:
scrotgnome-screenshotimportIf none are available, ask the user to install one of them and retry.
Coordinate regions require scrot or ImageMagick import.
--app, --window-name, and --list-windows are macOS-only. On Linux, use
--active-window or provide --window-id when available.
Run the PowerShell helper:
powershell -ExecutionPolicy Bypass -File {baseDir}/scripts/take_screenshot.ps1
Common patterns:
powershell -ExecutionPolicy Bypass -File {baseDir}/scripts/take_screenshot.ps1
powershell -ExecutionPolicy Bypass -File {baseDir}/scripts/take_screenshot.ps1 -Mode temp
powershell -ExecutionPolicy Bypass -File {baseDir}/scripts/take_screenshot.ps1 -Path "C:\Temp\screen.png"
powershell -ExecutionPolicy Bypass -File {baseDir}/scripts/take_screenshot.ps1 -Mode temp -Region 100,200,800,600
powershell -ExecutionPolicy Bypass -File {baseDir}/scripts/take_screenshot.ps1 -Mode temp -ActiveWindow
powershell -ExecutionPolicy Bypass -File {baseDir}/scripts/take_screenshot.ps1 -WindowHandle 123456
Use these when you cannot run the helpers.
screencapture -x output/screen.png
screencapture -x -R100,200,800,600 output/region.png
screencapture -x -l12345 output/window.png
screencapture -x -i output/interactive.png
scrot output/screen.png
gnome-screenshot -f output/screen.png
import -window root output/screen.png
scrot -a 100,200,800,600 output/region.png
import -window root -crop 800x600+100+200 output/region.png
scrot -u output/window.png
gnome-screenshot -w -f output/window.png
bash {baseDir}/scripts/ensure_macos_permissions.sh first to request Screen Recording in one place.ModuleCache permission errors in a sandboxed run, rerun the command with escalated permissions.--list-windows --app "AppName" and retry with --window-id, and make sure the app is visible on screen.command -v scrot, command -v gnome-screenshot, and command -v import.tools
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
tools
Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.
development
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.
testing
Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.