chengfeng-report-videocut-bug
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill implements a robust sanitization process in
scripts/report-bug.cjs. It uses a combination of key-based filtering and regex-based redaction to remove API keys, tokens, passwords, local file paths, and other sensitive identifiers from bug reports before they are presented to the user for confirmation. - [COMMAND_EXECUTION]: The skill uses
nodeand the GitHub CLI (gh) to perform its tasks. These commands are executed within a controlled workflow defined in theSKILL.mdinstructions. The shell command used to locate the plugin root directory is constrained to identifying the path of an already enabled and installed plugin via the platform's own plugin management tool (codex). - [PROMPT_INJECTION]: The skill contains clear instructions to the agent to avoid automatic submissions and functional suggestions. It enforces a strict multi-step process: diagnostic collection, sanitization, user review/confirmation, and finally, authenticated submission. The use of a
confirmationTokenand fingerprinting ensures that the agent cannot be tricked into submitting content the user has not explicitly reviewed.
Audit Metadata