broll-capture
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to run its bundled Puppeteer script (
node scripts/capture-shots.mjs), process video markers viaffmpeg, and interface with thescreenstudio-cliutility. All commands are used for their intended media production purposes. - [EXTERNAL_DOWNLOADS]: The skill interacts with external websites to capture visual content. It specifically references capturing data from well-known services like Twitter/X and GIPHY, including instructions for extracting public API tokens from network requests to facilitate searches.
- [INDIRECT_PROMPT_INJECTION]: Because the skill renders and processes content from external websites, it possesses an inherent attack surface for indirect prompt injection. The skill mitigates this risk by instructing the agent to perform a manual frame-by-frame review of all captured assets to ensure authenticity and correctness.
- [DYNAMIC_EXECUTION]: The bundled automation script employs
page.evaluate()to execute JavaScript in the browser context. This is used for benign UI cleanup tasks, such as programmatically hiding cookie consent dialogs and scrolling the page to trigger lazy-loading of images.
Audit Metadata