screencli-record
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Uses the
screenclicommand vianpxto record browser demos and manage cloud uploads. - [EXTERNAL_DOWNLOADS]: Fetches and executes the
screenclipackage from the npm registry at runtime. - [DATA_EXFILTRATION]: Uploads processed video recordings to the
screencli.shdomain to generate shareable links. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it employs an agent to interact with untrusted external websites.
- Ingestion points: Target URLs provided to the
recordcommand inSKILL.md. - Boundary markers: No explicit instructions are provided to the agent to ignore embedded prompts in the recorded websites.
- Capability inventory: The browser agent can navigate and interact with web pages, while the CLI tool manages local storage in
~/.screencliand performs cloud uploads. - Sanitization: No evidence of sanitization of website content is provided before interaction.
Audit Metadata