clipchamp-video

• [Sensitive Data Access]: The skill includes automation to clone Microsoft Edge user profiles, including cookies and local storage, to a local working directory (~/.copilot/video-work/edge-tenant). This is a design choice to maintain authentication for automated screen recording of protected applications like Copilot Studio.
• [System Command Execution]: The skill makes extensive use of PowerShell scripts and Node.js subprocesses to manage window positioning, terminate browser instances, and execute ffmpeg for screen capture and video encoding.
• [External Dependency Management]: The skill requires and installs several standard tools via well-known package managers (npm install -g playwright, pip install edge-tts, and winget install --id Gyan.FFmpeg). These are established utilities used for the skill's core video production features.
• [Indirect Prompt Injection Surface]: The recorder script monitors agent responses to detect completion (e.g., by checking for feedback buttons) and trigger narration beats. This creates a surface where the agent's output influences the automation timing.

Ingestion points:

• Agent response text and UI elements are monitored via Playwright locators in scripts/recorder.js.

Boundary markers:

• None observed for agent response monitoring.

Capability inventory:

• File system read/write (cloning profiles, writing logs, saving video).
• Process management (killing Edge and Node processes).
• System command execution (PowerShell scripts, ffmpeg).
• Network operations (Playwright browser navigation, TTS generation).

Sanitization:

• The skill uses standard Playwright selectors for interaction and does not appear to execute instructions embedded within the agent's text responses.