record-browser-gif
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The Python script
encode_gif.pyutilizes thesubprocessmodule to callffmpegandffprobe. These calls are implemented using lists for command arguments rather than shell strings, which effectively prevents shell injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill requiresffmpegandffprobeto be present on the system's PATH and explicitly instructs the agent not to install them if missing, ensuring that no unauthorized software is downloaded or executed during operation.\n- [DATA_EXFILTRATION]: The instructions inSKILL.mdcontain specific guidelines to prevent the capture of secrets, personal data, or unrelated browser information during the recording process. It also directs the agent to use standard configuration paths for credentials rather than echoing them to logs or the UI.\n- [REMOTE_CODE_EXECUTION]: No patterns for remote code execution or dynamic code evaluation (such aseval()orexec()) were found. The skill relies on pre-defined local scripts and verified system binaries.
Audit Metadata