before-and-after
Warn
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: Uploads captured screenshots to https://0x0.st, a public anonymous file hosting service. Evidence: scripts/adapters/0x0st.sh performs unauthenticated uploads.
- [DATA_EXFILTRATION]: Creates public GitHub Gists to host images when the gist adapter is used, potentially exposing screenshots. Evidence: scripts/adapters/gist.sh uses the --public flag.
- [DATA_EXFILTRATION]: Supports uploading images to arbitrary external endpoints via the BLOB_UPLOAD_URL environment variable in scripts/adapters/blob.sh.
- [EXTERNAL_DOWNLOADS]: Installs the @vercel/before-and-after package from NPM. This is a package from a recognized vendor.
- [COMMAND_EXECUTION]: Utilizes standard developer tools including gh, vercel, and npm for workflow integration.
Audit Metadata