skills/paldom/terminaltor/cast-render/Gen Agent Trust Hub

cast-render

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use standard command-line tools including agg, gifsicle, and ffmpeg. These tools are used as intended for their primary functions of rendering, optimizing, and converting media files.
  • [DATA_EXFILTRATION]: No data exfiltration patterns were detected. The skill actively promotes a secure workflow by recommending the use of a redaction tool (cast-redact) to identify and remove secrets from recording files before artifacts are generated or published.
  • [EXTERNAL_DOWNLOADS]: The documentation references the installation of the agg tool from a public GitHub repository. The repository is the official source for the tool and is maintained by the organization responsible for the asciicast format.
  • [INDIRECT_PROMPT_INJECTION]: While the skill processes external .cast files which could contain untrusted data, the risk is mitigated by the following:
  • Ingestion points: .cast files (JSON-based terminal recordings) are read by the agg tool.
  • Boundary markers: The workflow requires a precondition that the cast is sanitized or scanned via cast-redact.
  • Capability inventory: The skill uses subprocess calls to agg, gifsicle, ffmpeg, and ffprobe for pixel-level rendering and metadata inspection. No code execution of the content within the cast file occurs.
  • Sanitization: The skill recommends external redaction tools to filter sensitive content from the input stream.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 09:22 PM
Security Audit — agent-trust-hub — cast-render