Latchshot Page Capture

Latchshot page capture

Use the bundled dependency-free Node.js client to turn one public webpage URL into a validated local PNG, JPEG, or PDF artifact while keeping the LATCHSHOT_API_KEY out of chat, source, command arguments, and output.

When to invoke

• "Capture a screenshot of this public webpage."
• "Save a full-page PNG for this URL."
• "Create a PDF of a public website."
• "Generate a website thumbnail artifact."
• "Check my remaining Latchshot render quota."

Prerequisites and context

Require Node.js 20 or newer and network access. Authenticated capture and usage commands read the API key only from LATCHSHOT_API_KEY and send it only to the fixed https://latchshot.fly.dev origin. Never ask the user to paste the key into chat, a command argument, source code, a committed file, or output. Never print or return the key.

Latchshot is a hosted third-party service maintained by this skill's contributor. Keep its use optional and preserve local-browser workflows when the task needs private pages, authenticated pages, or unsupported browser actions.

Request boundaries

This includes social-preview captures, but not authenticated/private, private/internal, or private-page access.

Use --allow-query only after confirming the query contains no credential, signature, token, customer data, or other secret.

No-key demo

If LATCHSHOT_API_KEY is missing, use the no-key demo only when a bounded public viewport JPEG fits the request.

node scripts/latchshot.mjs demo \
  --url 'https://example.com' \
  --output './artifacts/example-demo.jpg'

The demo is JPEG-only, does not use an account or render quota, allows three attempts per IP address per hour, and accepts only width, height, query confirmation, and explicit overwrite options. The public URL is still sent to Latchshot with the coarse agentskill acquisition label. Treat the result as a proof artifact, not as customer activation or plan signup. For PNG, PDF, full-page, cleanup, or repeat work without a key, direct the user to https://latchshot.fly.dev/integrations.md#agent-skills and stop.

Capture workflow

1. Confirm the target is a public HTTP or HTTPS page and the output path is user-approved.
2. Run the client from this skill directory.
3. Parse the one-line JSON result and confirm ok, output, format, contentType, and bytes.
4. Inspect the local artifact when the surrounding task requires visual or document verification.
5. Report the path and render or quota diagnostics without exposing the key.

Viewport capture:

node scripts/latchshot.mjs capture \
  --url 'https://example.com' \
  --output './artifacts/example.png'

Full-page capture with lazy content activation:

node scripts/latchshot.mjs capture \
  --url 'https://example.com' \
  --output './artifacts/example-full.png' \
  --full-page \
  --scroll-page

PDF capture:

node scripts/latchshot.mjs capture \
  --url 'https://example.com' \
  --output './artifacts/example.pdf' \
  --paper A4

Best-effort cleanup flags are not bypass tools; treat each cleanup as best-effort only: --block-ads, --block-trackers, --block-chats, --hide-cookie-banners, and --hide-popups. The client refuses to overwrite a file unless --force is explicit. Report render/quota diagnostics only. Run node scripts/latchshot.mjs --help for the exact bounded options.

Usage and failure handling

Read quota without consuming render quota:

node scripts/latchshot.mjs usage

The usage command is read-only.

Progressive disclosure and bundled resources

Output template

## Latchshot capture result

**Status:** captured | demo-captured | blocked
**URL:** `<public URL>`
**Output:** `<local artifact path>`
**Format:** png | jpeg | pdf

### Render result
- `ok`: <true/false>
- `contentType`: <content type>
- `bytes`: <byte count>
- Diagnostics: <quota/reset/render notes with no API key>

### Boundaries checked
- Public HTTP(S): yes | no
- Query reviewed for secrets: yes | not applicable
- Auth/private/CAPTCHA/browser-action request: no | blocked because <reason>

Quality gate

• The URL is a public HTTP or HTTPS page and is not private, authenticated, signed, or secret-bearing.
• The command reads authenticated credentials only from LATCHSHOT_API_KEY.
• The output path is explicit, local, and not overwritten unless --force was intentional.
• The JSON result was parsed for ok, output, format, contentType, and bytes.
• Rate limits and demo limits were not bypassed by looping or identity switching.
• No raw HTML extraction, scraping, CAPTCHA bypass, arbitrary browser action, or commercial action was attempted.

References

• Latchshot service origin
• Agent Skills setup documentation