browser-video-recording
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/render_browser_demo.pyexecutes system commands includingswiftandffmpeg. These calls use list-formatted arguments rather than shell strings, which is a secure practice that prevents shell injection. - [COMMAND_EXECUTION]: The skill utilizes the macOS system utility
/usr/sbin/screencaptureto generate image assets for the video rendering process. - [PROMPT_INJECTION]: The skill processes user-influenced data through a JSON configuration file. Ingestion points: The
scripts/render_browser_demo.pyscript reads a configuration file provided via the--configargument. Boundary markers: No explicit delimiters are used in the configuration file generation. Capability inventory: The script has the ability to execute subprocesses (swift,ffmpeg) and write to the filesystem via thePILlibrary. Sanitization: The script relies on Python'ssubprocesslist-based execution to prevent argument injection, though it does not explicitly sanitize the contents of the JSON configuration.
Audit Metadata