browser-video-recording
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/render_browser_demo.pyexecutes an embedded Swift program by piping it to theswiftinterpreter viasubprocess.run. This allows the skill to execute non-Python code bundled as a string literal to perform macOS-specific tasks.- [COMMAND_EXECUTION]: The video rendering pipeline relies on calling multiple system binaries includingffmpeg,ffprobe,swift, and/usr/sbin/screencapture. These tools are used for image processing, metadata verification, and screen region capture.- [DATA_EXPOSURE]: The skill invokes the macOSscreencaptureutility to record the screen cursor area. While limited by the script's logic to a small bounding box, the use of screen recording tools is a privacy-sensitive operation.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON configuration files and image assets, providing a surface for untrusted data ingestion. - Ingestion points: JSON configuration file path and image file paths defined in the config.
- Boundary markers: None.
- Capability inventory: Subprocess calls to
ffmpeg,swift, andscreencapturefor file processing and screen capture. - Sanitization: None.
Audit Metadata