Took me a while to figure this out but apparently (at least on my setup with storybook 8) passing storybook URL with trailing slash for example:
storycap --serverCmd "npx http-server ./storybook-static --port 6006" http://127.0.0.1:6006/ --outDir ./screenshots
make storycap navigate to http://127.0.0.1:6006//iframe.html?... (note the double slash) and then it fails setting stories with uncaught SecurityError as follows

which BTW wasn't forwarded to console even with --forwardConsoleLogs --verbose flags and I could only observe it when I've disabled headless mode.
Changing from http://127.0.0.1:6006/ to http://127.0.0.1:6006 fixes the problem