use-screenkite-advanced-b-roll

Fail

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides an installation command for the uv tool from the astral.sh domain using a shell pipe (curl | sh).
  • [EXTERNAL_DOWNLOADS]: Fetches external software and libraries including the uv tool from Astral, the hyperframes CLI from HeyGen via npx, and the GSAP animation library from the JSDelivr CDN.
  • [COMMAND_EXECUTION]: Utilizes subprocess.run within Python scripts to execute ffmpeg for audio conversion and the ScreenKite desktop application CLI for layout management.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes transcription data obtained from the ElevenLabs Scribe API, which is an untrusted external source. 1. Ingestion points: Audio transcription data is processed in scripts/transcribe_mic.py and scripts/pack_transcripts.py. 2. Boundary markers: The pipeline includes a mandatory manual proofreading step (Phase 3b) to verify text content before visual generation. 3. Capability inventory: The skill has capabilities to write files and execute commands via subprocess.run and npx. 4. Sanitization: There is no automated sanitization of the transcript text before it is used to plan visual overlays.
Recommendations
  • HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 14, 2026, 06:03 PM