enhance-readme
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands via Playwright (
npx --yes @playwright/cli@latest) and FFmpeg (via the@ffmpeg-installer/ffmpegpackage). These commands are used for browser automation, screenshot capture, and video-to-GIF conversion. The executions are scoped to user-defined URLs and local project directories. - [EXTERNAL_DOWNLOADS]: The skill utilizes standard, well-known Node.js packages from the NPM registry, specifically
playwrightfor browser automation and@ffmpeg-installer/ffmpegfor media processing. - [CREDENTIALS_UNSAFE]: The
record-readme-tour.mjsscript accepts--userand--passarguments to automate login flows for the demo site being captured. While these are handled as command-line arguments, the skill context implies these are for public-facing demo environments, and no hardcoded secrets are present in the code. - [DYNAMIC_EXECUTION]: The skill uses Playwright's
evalandaddInitScriptfunctions to programmatically interact with the demo website's DOM (e.g., toggling dark mode via CSS classes) andlocalStorage(e.g., pre-seeding state to skip onboarding overlays). This execution is restricted to the browser context of the target URL.
Audit Metadata