screen-recorder
Warn
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill generates a custom Node.js script (
record.mjs) and a Bash script (crop.sh) at runtime based on templates and executes them to perform browser automation and video processing. - [COMMAND_EXECUTION]: The skill relies on various system commands to verify the environment and process video files, including
npx,ffmpeg,ffprobe,jq, andcurl. - [EXTERNAL_DOWNLOADS]: During its preflight phase, the skill may prompt the user to download and install the Playwright package, the Chromium browser driver (approximately 150MB), and the ffmpeg utility.
- [PROMPT_INJECTION]: The skill ingests untrusted data such as URLs, CSS selectors, and interaction sequences. These values are interpolated into the generated scripts, creating a potential surface for indirect prompt injection or logic bypass, although the skill uses
JSON.stringifyand action whitelists to mitigate these risks.
Audit Metadata