pair-programmer
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js and Electron scripts to manage the recording lifecycle and interact with the VideoDB service. It also uses standard system utilities such as
grep,tail, andjqto filter and process locally stored event logs. - [EXTERNAL_DOWNLOADS]: During setup, the skill fetches standard dependencies including
electron,videodb, anddotenvfrom the official npm registry. These packages are reputable and directly associated with the skill's core functionality. - [DATA_EXFILTRATION]: Captured screen descriptions and audio transcripts are transmitted to the vendor's API at
api.videodb.iofor indexing and search. This operation is the primary purpose of the skill, is authenticated via a user-provided API key, and targets the vendor's documented infrastructure. - [PROMPT_INJECTION]: The skill processes untrusted data from the user's environment (screen content and microphone audio), creating a surface for indirect prompt injection (Category 8). However, as this is the primary function of the tool and the data is used for context-aware summaries, the risk is considered low and inherent to the intended use case.
Audit Metadata