pr-video-review
Pass
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/record_scroll_motion.mjsspawns anffmpegprocess to convert WebM recordings to MP4. File paths used in the command are sanitized via slugification to prevent command injection. - [EXTERNAL_DOWNLOADS]: The skill resolves the
playwrightdependency from the user's local project environment. Playwright is a well-known and trusted library for browser automation. - [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection by navigating a browser to and recording content from user-specified URLs.
- Ingestion points:
base-urlandrouteparameters inscripts/record_scroll_motion.mjs. - Boundary markers: Content is recorded in an automated browser context without specific prompt delimiters for the external page content.
- Capability inventory: Headless browser automation and video transcoding via subprocess spawning.
- Sanitization: Inputs are validated via the
URLconstructor and routes are converted to safe slugs for filenames to avoid injection.
Audit Metadata