video-publisher
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local Node.js and shell scripts to automate browser tasks via Ego Lite. All commands are executed within the scope of the intended functionality (video preparation and metadata management).
- [DATA_EXPOSURE]: User configuration is stored in the standard platform-specific configuration directory ($XDG_CONFIG_HOME or ~/.config) with restricted file permissions (0600). The skill explicitly avoids persisting sensitive information such as cookies, credentials, or video-specific paths within the shareable skill folder.
- [DYNAMIC_EXECUTION]: Browser automation scripts are assembled from local modules and executed via ego-browser. User-supplied data (titles, descriptions, tags) is safely serialized into these scripts using standard JSON serialization. No untrusted remote code is fetched or executed.
- [PERSISTENCE]: The skill maintains local job state and checkpoints in a dedicated directory (~/.video-publisher/v2-jobs) to allow for recovery and interruption handling. This is standard operational state management for automation tasks and does not involve persistent backdoors.
- [SAFE]: The skill implements a "Safety Boundary" that installs a capture-phase event guard in the browser to prevent the automation from clicking final publish buttons without explicit user authorization in the current session. It also uses atomic file writes and backups for state persistence to ensure reliability.
Audit Metadata