·
Last changedVersion:
This version passed the hardening gate. Hardening applied 3 targeted changes and preserved all other text. Classified findings before hardening: 4. Classified findings closed: 2. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 5. Review findings remaining: 13.
2
2
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Tool & MCP Manipulation | MCP over-permissioning | Medium | Open | |
tools/eyeball.py | Malicious Code & Command Execution | Dynamic code execution | Medium | Open | |
SKILL.md | Malicious Code & Command Execution | — | Low | Closed | |
SKILL.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Closed |
4 findings
Analyze documents with visual proof. When activated, Eyeball produces a Word document on the user's Desktop where every factual assertion includes an inline screenshot from the source material with the cited text highlighted in yellow.
When the user invokes this skill (e.g., "use eyeball", "run eyeball on this", "eyeball this document"), respond with:
Then follow the workflow below.
The Eyeball Python utility is located at:
To find the actual path, run:
Before first use, check that dependencies are installed:
Follow these steps exactly. The order matters.
Before writing any analysis, extract and read the full text of the source document:
Read the output carefully. Identify actual section numbers, headings, page numbers, and key language.
CRITICAL: Do not skip this step. Do not write analysis based on assumptions about how the document is structured. Read the actual text.
For each point in your analysis, you must:
This is the most important step. Anchors determine what gets highlighted in the screenshots.
DO:
DO NOT:
Examples:
WRONG -- uses a generic topic label that matches everywhere:
RIGHT -- uses the specific language that supports the claim:
WRONG -- section title appears as a cross-reference on earlier pages:
RIGHT -- includes the section number for precision, targets the correct page:
Construct a JSON array of sections and call the build command:
Section object fields:
heading (required): Section heading in the output documentanalysis (required): Your analysis textanchors (required): List of verbatim phrases from the source to search for and highlighttarget_page (optional): Single page number (1-indexed) to search ontarget_pages (optional): List of page numbers to search across (screenshots stitched vertically)context_padding (optional): Padding in PDF points above/below the anchor region (default: 40). Increase for more context.Save the output to the user's Desktop. Tell the user the filename and that they can open it to verify each claim against the highlighted source screenshots.
Before saving the final document, mentally verify:
Get started with chainctlchainctl skill install public/github/eyeball:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/github/skills/eyeball:latest
MIT
HARDENING.md
LICENSE
SKILL.md
tools/eyeball.py