Skills screenci
๐Ÿ“ฆ

screenci

Content revision r2 High Risk ๐Ÿ“ Filesystem accessโš™๏ธ External commands๐ŸŒ Network access

Create ScreenCI Product Videos

Browser demonstrations can be difficult to script, narrate, and record consistently. This skill builds and verifies ScreenCI scripts, then records and uploads finished videos.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "screenci" from https://skillstore.io/skills/screenci-screenci.md and its manifest at https://skillstore.io/api/skills/screenci-screenci/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "screenci". Record the billing update flow with narration and a fixed frame around the form.

Expected outcome:

Created the billing walkthrough, added narration cues, framed the form, and verified the complete flow. Upload is waiting for your approval.

Using "screenci". Fix the reports tour and record it after the selectors pass.

Expected outcome:

  • Updated the report filters to use stable role-based selectors.
  • Verified the recording test successfully.
  • Prepared the recording and identified the local artifact location.

Security Audit

High Risk
v3 โ€ข 7/23/2026 Open versioned report

The skill intentionally runs ScreenCI commands and uploads browser recordings to an external service. Most shell findings are Markdown or API references, but actual npm and npx commands, command-line secret handling, and upload behavior are confirmed risks. The unmatched prompt-wrapper closing tags and the instruction to upload without confirmation add high-confidence semantic concerns.

3
Files scanned
258
Lines analyzed
4
Review items
0
False positives ignored

Confirmed security concerns (7)

High
Environment file access
- If the user already has a `SCREENCI_SECRET` from an existing account, pass it as init's first posi
The instruction passes SCREENCI_SECRET as an initializer argument before writing it to screenci/.env. Command-line arguments can expose the shared credential through shell history or process inspection.
High
Screen capture upload
npx screenci record # capture the final recording and upload
The command explicitly captures the final browser recording and uploads it. Recorded pages can contain private or authenticated information.
High
Screen capture upload
Use `screenci record` to capture ScreenCI videos from `.screenci.ts` scripts.
The command captures browser activity, and the same workflow uploads every successful recording. Screen content can include sensitive application data.
High
Screen capture upload
npx screenci record # capture the final recording
The final command starts ScreenCI recording, whose documented runtime behavior includes upload. This creates a direct external disclosure risk for captured content.
High
Environment file access
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The command places SCREENCI_SECRET in a process argument and gives it to an unpinned initializer. This can expose a shared organization credential.
High
Unconfirmed Screen Recording Upload
The skill says, "Do not stop and ask the user to record. It uploads immediately." This bypasses confirmation before browser content leaves the device.
The instruction explicitly requires immediate upload and discourages pausing for user action. The behavior can disclose authenticated pages or private data.
High
Prompt Injection Attempt Detected
The file ends with unmatched "</content>" and "</invoke>" tags. These tags can terminate prompt wrappers and alter how following instructions are interpreted.
The closing tags have no matching opening tags or ScreenCI purpose. Their wrapper-like names strongly indicate an attempted prompt-boundary escape.
Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Ruby/shell backtick execution
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The line instructs execution of npm init screenci@latest with a secret argument. It runs external package code while exposing a credential on the command line.
High
Ruby/shell backtick execution
3. Run `npx screenci record` yourself once tests pass. Do not stop and ask the user to record. It up
The instruction requires the agent to run npx screenci record. The command captures browser content and immediately uploads it.
Medium
Ruby/shell backtick execution
```bash
The fenced block contains npx screenci test and record commands. These commands execute an external package and can start browser automation or upload.
Medium
Ruby/shell backtick execution
2. Run `npx screenci test` until it passes. Fix selectors/flow/narration and rerun until green.
The instruction requires repeated execution of npx screenci test. This launches third-party package code and local browser automation.

Detected Patterns

Screen capture uploadร—3
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/screenci-screenci/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/screenci-screenci/security.svg)](https://skillstore.io/skills/screenci-screenci?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/screenci-screenci?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/screenci-screenci/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/screenci-screenci.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

screenci. (2026). screenci security audit report (audit version 3) [Author version unspecified]. Skillstore. https://skillstore.io/skills/screenci-screenci/audits/3

BibTeX citation

@techreport{screenci-screenci-screenci-2026, author = {screenci}, title = {screenci security audit report (audit version 3)}, institution = {Skillstore}, year = {2026}, number = {3}, url = {https://skillstore.io/skills/screenci-screenci/audits/3}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "screenci security audit report (audit version 3)" version: "unspecified" type: report authors: - name: "screenci" date-released: "2026-07-23" url: "https://skillstore.io/skills/screenci-screenci/audits/3" identifiers: - type: other value: "skillstore:screenci-screenci:audit:3" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
41
Architecture
85
Maintainability
87
Content
67
Community
83
Spec Compliance

What You Can Build

Publish a release walkthrough

Create a narrated browser video that demonstrates a completed feature and its expected user flow.

Build a support tutorial

Turn a repeatable customer workflow into a focused video with clear narration and controlled framing.

Record a validated test flow

Convert stable Playwright interactions into a tested ScreenCI recording with visible navigation and reusable selectors.

Try These Prompts

Record a basic flow
Create a ScreenCI video for [flow] in this initialized project. Test it locally, ask before upload, then report the recording link.
Improve narration and framing
Update [recording file] with continuous narration. Hide setup, use stable zoom for forms, and keep navigation visible after the start page.
Repair a failing recording
Run the ScreenCI test for [recording file]. Fix selectors, timing, narration cues, and navigation until the test passes without forced actions.
Build an advanced product tour
Create a multilingual ScreenCI tour for [journey]. Add selected overlays and audio, validate every route, request upload approval, and report all artifacts.

Best Practices

  • Test every recording locally before starting capture or upload.
  • Remove secrets and private customer data from all visible pages and test fixtures.
  • Request explicit approval immediately before any recording leaves the device.

Avoid

  • Do not upload authenticated browser sessions without reviewing every visible state.
  • Do not pass shared secrets through command-line arguments or include them in scripts.
  • Do not rely on forced clicks, arbitrary delays, or unstable selectors to hide test failures.

Frequently Asked Questions

Does this skill require an existing ScreenCI project?
Yes. Its primary workflow assumes ScreenCI is initialized and edits scripts in the recordings directory.
Can it create narration?
Yes. It adds required narration cues and can coordinate speech with browser actions.
Does recording upload data?
Yes. ScreenCI uploads every successful recording, including recordings made through an anonymous trial session.
Can I test without an account?
Yes. Local tests and anonymous recording do not require a ScreenCI account.
Where are local recording artifacts stored?
ScreenCI stores each video under its local output directory with the recording and related data.
What should I review before upload?
Review visible pages, test data, authentication state, narration, overlays, and audio. Remove all secrets and private information.

Developer Details

Author

screenci

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Ref

ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006

Maintenance freshness

7/26/2026

Usage

2 downloads ยท 0 views

File structure

๐Ÿ“ references/

๐Ÿ“„ init.md

๐Ÿ“„ record.md

๐Ÿ“„ SKILL.md

More from screenci

View all
View all