cast-redact
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bundled Python script (
scripts/redact_cast.py) to process.castfiles via command-line invocation. This is the intended primary purpose of the skill and is implemented with multiple safety layers: - It requires separate input and output file paths to prevent accidental data loss.
- It performs a verification scan on the generated output file to ensure all targeted patterns were successfully removed.
- It uses regex-based redaction on a joined stream, effectively catching secrets that are typed one character at a time (keystrokes).
- [DATA_EXPOSURE_&_EXFILTRATION]: The skill instructions explicitly warn against loading raw sensitive
.castfiles into the model context, which is a security best practice for handling potentially compromised recordings. It also recommends using a gitignoredsecrets.mapfile for literal replacements rather than passing secrets as command-line arguments, preventing them from appearing in shell history or process lists. - [PROMPT_INJECTION]: No malicious patterns, bypass attempts, or instructions to ignore safety guidelines were detected in the skill markdown or metadata.
Audit Metadata