techsmith-core-workflow-a
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external inputs such as capture subjects and destination paths, which serves as a potential vector for instructions embedded in data.
- Ingestion points: The skill accepts a
[script-path]and[approved-output-directory]via arguments and processes user-defined capture subjects. - Boundary markers: Instructions explicitly mandate path validation, canonicalization of the
LastFileWrittenproperty, and checks to ensure the output path does not escape the approved boundary. - Capability inventory: The skill uses
WriteandEdittools alongside theSnagit.ImageCapture.1COM interface to generate and manage image files. - Sanitization: The contract requires redacting all activation keys, account identifiers, and sensitive endpoint details before returning output.
- [EXTERNAL_DOWNLOADS]: The skill references and fetches content from official TechSmith infrastructure and repositories.
- Evidence: References documentation and PDF guides from
assets.techsmith.comandsupport.techsmith.com. - Evidence: Directs users to official PowerShell samples hosted in the
TechSmithGitHub organization.
Audit Metadata