The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/render_browser_demo.py executes multiple system commands, including ffmpeg, ffprobe, and swift, using the subprocess module to handle video rendering and asset extraction.
[DYNAMIC_EXECUTION]: The Python rendering script contains a hardcoded Swift source code string (SWIFT_CURSOR_CAPTURE) that is executed at runtime by piping it to the swift interpreter. This technique is used to interface with macOS-specific APIs for cursor extraction.
[DATA_EXFILTRATION]: The skill uses the /usr/sbin/screencapture utility to take screenshots of the user's desktop. Although restricted to a small region around the cursor, this functionality involves accessing sensitive visual data from the host system.
[INDIRECT_PROMPT_INJECTION]: The skill processes external configuration data which could potentially be used to influence file paths or command parameters if the input is untrusted.
Ingestion points: The scripts/render_browser_demo.py script reads a JSON configuration file provided via the --config command-line argument.
Boundary markers: No explicit delimiters or safety warnings are implemented for the data ingested from the configuration file.
Capability inventory: The script possesses capabilities to read/write files via the Pillow library, execute system commands via subprocess, and capture screen data via the system screencapture utility.
Sanitization: The script does not use shell=True in its subprocess calls, which helps prevent basic shell injection, but it does not perform exhaustive validation of the JSON configuration content.

browser-video-recording