demo-gif

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install developer tools from well-known and reputable sources, such as GitHub (Charm, Playwright), official repository mirrors (repo.charm.sh), and standard package managers (Homebrew, Scoop, npm). These downloads are necessary for the skill's primary functionality.
  • [COMMAND_EXECUTION]: The skill's core workflow involves executing standard CLI tools like vhs, ffmpeg, gifsicle, and npm to record, render, and optimize GIF files. These operations are expected for a documentation and recording utility.
  • [PRIVILEGE_ESCALATION]: Installation instructions for Linux users include the use of sudo to add repository GPG keys and install packages via apt. This is a standard and transparent administrative procedure for package management.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes repository metadata, such as package.json and directory structure, to recommend the best demo type. While scanning external files presents an ingestion surface, the logic is limited to identifying project types and does not involve executing instructions embedded in those files.
  • [DYNAMIC_EXECUTION]: The skill generates and executes temporary recording scripts, including .tape files for vhs and Playwright scripts. These scripts are created from established templates based on the user's repository and are a core feature for enabling reproducible recordings.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 05:55 PM