pair-programmer

Pass

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Node.js and Electron scripts to manage the recording lifecycle and interact with the VideoDB service. It also uses standard system utilities such as grep, tail, and jq to filter and process locally stored event logs.
  • [EXTERNAL_DOWNLOADS]: During setup, the skill fetches standard dependencies including electron, videodb, and dotenv from the official npm registry. These packages are reputable and directly associated with the skill's core functionality.
  • [DATA_EXFILTRATION]: Captured screen descriptions and audio transcripts are transmitted to the vendor's API at api.videodb.io for indexing and search. This operation is the primary purpose of the skill, is authenticated via a user-provided API key, and targets the vendor's documented infrastructure.
  • [PROMPT_INJECTION]: The skill processes untrusted data from the user's environment (screen content and microphone audio), creating a surface for indirect prompt injection (Category 8). However, as this is the primary function of the tool and the data is used for context-aware summaries, the risk is considered low and inherent to the intended use case.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 14, 2026, 08:06 AM