render-chatgpt-chat

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local command execution for media recording and assembly:
  • Node.js scripts (record-chat.js, render-end-card.js) are used to manage Playwright recording sessions and template rendering.
  • A Bash script (stitch.sh) coordinates the final video production using ffmpeg and ffprobe to transcode video and mux audio tracks.
  • An inline Python script within stitch.sh is used to calculate precise audio timing for the subliminal sound effect cues.
  • [EXTERNAL_DOWNLOADS]: The skill's setup process involves standard external dependency acquisition:
  • Downloads the playwright package via the official NPM registry.
  • Installs the Chromium browser engine using the standard npx playwright install command to enable browser-based UI recording.
  • [SAFE]: The skill processes user-supplied conversation threads and configuration JSON files locally. The generate.js script correctly sanitizes message content using an escapeHTML function before rendering it into the HTML mockup, preventing potential injection issues within the local browser environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 09:42 AM
Security Audit — agent-trust-hub — render-chatgpt-chat