skills/iaskshahram/skills/screencast/Gen Agent Trust Hub

screencast

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @tmhs/screencast-mcp package from the NPM registry to function as the underlying MCP server.
  • [REMOTE_CODE_EXECUTION]: The configuration instructions utilize npx -y @tmhs/screencast-mcp, which downloads and executes the server code directly at runtime.
  • [COMMAND_EXECUTION]: The skill relies on ffmpeg and ffprobe binaries for media processing, editing (trim, crop, redact), and metadata extraction.
  • [INDIRECT_PROMPT_INJECTION]: The agent is instructed to process screen captures and video frames by converting them to PNGs and reading them. This creates a potential attack surface where malicious instructions displayed on the user's screen (e.g., in a browser window or text document) could be interpreted as commands by the agent when it 'sees' the frames.
  • Ingestion points: Frames sampled from video recordings and screenshots (PNG files) referenced in SKILL.md.
  • Boundary markers: None identified in the prompt templates.
  • Capability inventory: The skill has extensive capabilities to read/write files and execute media manipulation via ffmpeg across the local system.
  • Sanitization: None identified; the skill relies on the agent's internal vision capabilities to parse the visual data without a text-based sanitization layer.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 08:19 PM