feature-video
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several shell commands to facilitate video recording and PR management.
- Uses
gh pr viewandgh pr editto interact with GitHub Pull Requests. - Uses
ffmpegto process screenshots into video and GIF formats. - Uses
agent-browserto perform UI interactions and capture screenshots. - Uses
rclone copyto upload media files to cloud storage. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to install an external dependency.
- Recommends global installation of
agent-browservianpm install -g agent-browserif not already present. - [DATA_EXFILTRATION]: The skill is designed to upload local data to external storage.
- Uploads screenshots and video files to a cloud storage remote (e.g., R2 via
rclone). While this is the intended functionality, the script contains a hardcoded path (r2:kieran-claude/pr-videos/) which assumes a specific rclone configuration. - [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes external data.
- Ingestion points: Fetches Pull Request titles, bodies, and file lists using the GitHub CLI (
SKILL.md). - Boundary markers: No specific delimiters are used when the agent processes or appends to the PR body.
- Capability inventory: The skill can execute shell commands, manage files, and modify PR content (
SKILL.md). - Sanitization: No explicit sanitization of the PR content is performed before it is used in documentation updates.
Audit Metadata