enhance-readme

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands via Playwright (npx --yes @playwright/cli@latest) and FFmpeg (via the @ffmpeg-installer/ffmpeg package). These commands are used for browser automation, screenshot capture, and video-to-GIF conversion. The executions are scoped to user-defined URLs and local project directories.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes standard, well-known Node.js packages from the NPM registry, specifically playwright for browser automation and @ffmpeg-installer/ffmpeg for media processing.
  • [CREDENTIALS_UNSAFE]: The record-readme-tour.mjs script accepts --user and --pass arguments to automate login flows for the demo site being captured. While these are handled as command-line arguments, the skill context implies these are for public-facing demo environments, and no hardcoded secrets are present in the code.
  • [DYNAMIC_EXECUTION]: The skill uses Playwright's eval and addInitScript functions to programmatically interact with the demo website's DOM (e.g., toggling dark mode via CSS classes) and localStorage (e.g., pre-seeding state to skip onboarding overlays). This execution is restricted to the browser context of the target URL.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 05:56 AM
Security Audit — agent-trust-hub — enhance-readme