browser-video-recording

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/render_browser_demo.py executes an embedded Swift program by piping it to the swift interpreter via subprocess.run. This allows the skill to execute non-Python code bundled as a string literal to perform macOS-specific tasks.- [COMMAND_EXECUTION]: The video rendering pipeline relies on calling multiple system binaries including ffmpeg, ffprobe, swift, and /usr/sbin/screencapture. These tools are used for image processing, metadata verification, and screen region capture.- [DATA_EXPOSURE]: The skill invokes the macOS screencapture utility to record the screen cursor area. While limited by the script's logic to a small bounding box, the use of screen recording tools is a privacy-sensitive operation.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON configuration files and image assets, providing a surface for untrusted data ingestion.
  • Ingestion points: JSON configuration file path and image file paths defined in the config.
  • Boundary markers: None.
  • Capability inventory: Subprocess calls to ffmpeg, swift, and screencapture for file processing and screen capture.
  • Sanitization: None.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 03:10 AM
Security Audit — agent-trust-hub — browser-video-recording