use-screenkite-advanced-b-roll
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides an installation command for the
uvtool from theastral.shdomain using a shell pipe (curl | sh). - [EXTERNAL_DOWNLOADS]: Fetches external software and libraries including the
uvtool from Astral, thehyperframesCLI from HeyGen vianpx, and the GSAP animation library from the JSDelivr CDN. - [COMMAND_EXECUTION]: Utilizes
subprocess.runwithin Python scripts to executeffmpegfor audio conversion and theScreenKitedesktop application CLI for layout management. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes transcription data obtained from the ElevenLabs Scribe API, which is an untrusted external source. 1. Ingestion points: Audio transcription data is processed in
scripts/transcribe_mic.pyandscripts/pack_transcripts.py. 2. Boundary markers: The pipeline includes a mandatory manual proofreading step (Phase 3b) to verify text content before visual generation. 3. Capability inventory: The skill has capabilities to write files and execute commands viasubprocess.runandnpx. 4. Sanitization: There is no automated sanitization of the transcript text before it is used to plan visual overlays.
Recommendations
- HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata