broll-capture

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands to run its bundled Puppeteer script (node scripts/capture-shots.mjs), process video markers via ffmpeg, and interface with the screenstudio-cli utility. All commands are used for their intended media production purposes.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with external websites to capture visual content. It specifically references capturing data from well-known services like Twitter/X and GIPHY, including instructions for extracting public API tokens from network requests to facilitate searches.
  • [INDIRECT_PROMPT_INJECTION]: Because the skill renders and processes content from external websites, it possesses an inherent attack surface for indirect prompt injection. The skill mitigates this risk by instructing the agent to perform a manual frame-by-frame review of all captured assets to ensure authenticity and correctness.
  • [DYNAMIC_EXECUTION]: The bundled automation script employs page.evaluate() to execute JavaScript in the browser context. This is used for benign UI cleanup tasks, such as programmatically hiding cookie consent dialogs and scrolling the page to trigger lazy-loading of images.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 05:24 PM