demo-gif
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install developer tools from well-known and reputable sources, such as GitHub (Charm, Playwright), official repository mirrors (repo.charm.sh), and standard package managers (Homebrew, Scoop, npm). These downloads are necessary for the skill's primary functionality.
- [COMMAND_EXECUTION]: The skill's core workflow involves executing standard CLI tools like
vhs,ffmpeg,gifsicle, andnpmto record, render, and optimize GIF files. These operations are expected for a documentation and recording utility. - [PRIVILEGE_ESCALATION]: Installation instructions for Linux users include the use of
sudoto add repository GPG keys and install packages viaapt. This is a standard and transparent administrative procedure for package management. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes repository metadata, such as
package.jsonand directory structure, to recommend the best demo type. While scanning external files presents an ingestion surface, the logic is limited to identifying project types and does not involve executing instructions embedded in those files. - [DYNAMIC_EXECUTION]: The skill generates and executes temporary recording scripts, including
.tapefiles forvhsand Playwright scripts. These scripts are created from established templates based on the user's repository and are a core feature for enabling reproducible recordings.
Audit Metadata