record-browser-gif

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The Python script encode_gif.py utilizes the subprocess module to call ffmpeg and ffprobe. These calls are implemented using lists for command arguments rather than shell strings, which effectively prevents shell injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill requires ffmpeg and ffprobe to be present on the system's PATH and explicitly instructs the agent not to install them if missing, ensuring that no unauthorized software is downloaded or executed during operation.\n- [DATA_EXFILTRATION]: The instructions in SKILL.md contain specific guidelines to prevent the capture of secrets, personal data, or unrelated browser information during the recording process. It also directs the agent to use standard configuration paths for credentials rather than echoing them to logs or the UI.\n- [REMOTE_CODE_EXECUTION]: No patterns for remote code execution or dynamic code evaluation (such as eval() or exec()) were found. The skill relies on pre-defined local scripts and verified system binaries.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 08:26 PM
Security Audit — agent-trust-hub — record-browser-gif