📦
Audit History
screenci - 3 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 3 Latest
Jul 23, 2026, 07:40 PM
The skill intentionally runs ScreenCI commands and uploads browser recordings to an external service. Most shell findings are Markdown or API references, but actual npm and npx commands, command-line secret handling, and upload behavior are confirmed risks. The unmatched prompt-wrapper closing tags and the instruction to upload without confirmation add high-confidence semantic concerns.
3
Files scanned
258
Lines analyzed
14
Review items
0
False positives ignored
Confirmed security concerns (7)
High
Environment file access
- If the user already has a `SCREENCI_SECRET` from an existing account, pass it as init's first posi
The instruction passes SCREENCI_SECRET as an initializer argument before writing it to screenci/.env. Command-line arguments can expose the shared credential through shell history or process inspection.
High
Screen capture upload
npx screenci record # capture the final recording and upload
The command explicitly captures the final browser recording and uploads it. Recorded pages can contain private or authenticated information.
High
Screen capture upload
Use `screenci record` to capture ScreenCI videos from `.screenci.ts` scripts.
The command captures browser activity, and the same workflow uploads every successful recording. Screen content can include sensitive application data.
High
Screen capture upload
npx screenci record # capture the final recording
The final command starts ScreenCI recording, whose documented runtime behavior includes upload. This creates a direct external disclosure risk for captured content.
High
Environment file access
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The command places SCREENCI_SECRET in a process argument and gives it to an unpinned initializer. This can expose a shared organization credential.
High
Unconfirmed Screen Recording Upload
The skill says, "Do not stop and ask the user to record. It uploads immediately." This bypasses confirmation before browser content leaves the device.
The instruction explicitly requires immediate upload and discourages pausing for user action. The behavior can disclose authenticated pages or private data.
High
Prompt Injection Attempt Detected
The file ends with unmatched "</content>" and "</invoke>" tags. These tags can terminate prompt wrappers and alter how following instructions are interpreted.
The closing tags have no matching opening tags or ScreenCI purpose. Their wrapper-like names strongly indicate an attempted prompt-boundary escape.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The line instructs execution of npm init screenci@latest with a secret argument. It runs external package code while exposing a credential on the command line.
High
Ruby/shell backtick execution
3. Run `npx screenci record` yourself once tests pass. Do not stop and ask the user to record. It up
The instruction requires the agent to run npx screenci record. The command captures browser content and immediately uploads it.
Medium
Ruby/shell backtick execution
```bash
The fenced block contains npx screenci test and record commands. These commands execute an external package and can start browser automation or upload.
Medium
Ruby/shell backtick execution
2. Run `npx screenci test` until it passes. Fix selectors/flow/narration and rerun until green.
The instruction requires repeated execution of npx screenci test. This launches third-party package code and local browser automation.
Risk Factors
📁 Filesystem access (6)
⚙️ External commands (40)
SKILL.md:3 SKILL.md:12 SKILL.md:16 SKILL.md:22 SKILL.md:24-33 SKILL.md:33-35 SKILL.md:35 SKILL.md:39-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44 SKILL.md:45-49 SKILL.md:49-50 SKILL.md:50-51 SKILL.md:51 SKILL.md:53-76 SKILL.md:76-80 SKILL.md:80 SKILL.md:82 SKILL.md:83 SKILL.md:92-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95 SKILL.md:96 SKILL.md:100 SKILL.md:102-117 SKILL.md:117-121 SKILL.md:121 SKILL.md:123 SKILL.md:125 SKILL.md:126 SKILL.md:128-132 SKILL.md:132 SKILL.md:133-134 SKILL.md:134 SKILL.md:135 SKILL.md:136 SKILL.md:138
🌐 Network access (1)
Detected Patterns
Screen capture uploadScreen capture uploadScreen capture upload
Audited by: codex
Jul 8, 2026, 08:29 AM
The audit confirms real external command, secret-handling, and screen-recording upload risks in the ScreenCI workflow. Most Ruby backtick detections are Markdown false positives, but record commands upload captured screens and SCREENCI_SECRET is written to screenci/.env. SKILL.md also contains suspicious XML-like closing tags that should be removed.
3
Files scanned
258
Lines analyzed
27
Review items
0
False positives ignored
Confirmed security concerns (11)
High
Environment file access
- If the user already has a `SCREENCI_SECRET` from an existing account, pass it as init's first posi
SCREENCI_SECRET is an organization upload credential and the instruction passes it into project setup. Handling that secret in commands and env files is a real sensitive-data risk.
High
Screen capture upload
npx screenci record # capture the final recording and upload
The command comment says npx screenci record captures the final recording and uploads it. This can send captured application screens to an external ScreenCI service.
High
Environment file access
To upload straight to an existing organization instead, get `SCREENCI_SECRET` into `screenci/.env` b
The instruction handles SCREENCI_SECRET for organization uploads. The credential could be exposed through the env file or surrounding workflow.
High
Environment file access
- Or ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.env`. The org se
The line explicitly directs use of SCREENCI_SECRET from a secrets page. This is valid product setup, but it is still sensitive credential handling.
High
Screen capture upload
Use `screenci record` to capture ScreenCI videos from `.screenci.ts` scripts.
The file defines screenci record as the way to capture ScreenCI videos, and the same workflow documents upload behavior. Screen capture of app flows can include private data.
High
Screen capture upload
npx screenci record # capture the final recording
The command captures the final recording, and the record documentation states successful recordings upload. This is a real screen-capture upload workflow.
High
Environment file access
To upload straight to an existing organization, get `SCREENCI_SECRET` into `screenci/.env` before th
The line handles SCREENCI_SECRET before upload. This is a credential for organization recording uploads, so exposure would affect account resources.
High
Environment file access
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The line passes SCREENCI_SECRET to an npm init command and writes it into screenci/.env. Passing secrets on command lines and storing them locally is sensitive.
High
Environment file access
2. **Secrets page:** ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.
The line asks for SCREENCI_SECRET from a secrets page and stores it in screenci/.env. This is real credential handling, even if it supports a normal product workflow.
High
Prompt Injection Attempt Detected
SKILL.md ends with XML-like closing text "</content>" and "</invoke>" after the task reference. These tags could try to close prompt wrappers and change how the skill is interpreted.
The exact closing tags appear in the skill file and are not normal Markdown instructions. There is no explicit override command, so confidence is high but not absolute.
High
Autonomous Screen Recording Upload
The skill instructs the agent to run npx screenci record itself and states that it uploads immediately. This can send captured application screens to ScreenCI without a separate final confirmation.
The file directly says to run record yourself and that it uploads immediately. The record reference independently states successful recordings upload and return a ScreenCI URL.
Capability review items (13)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The line instructs running npm init screenci@latest with SCREENCI_SECRET as an argument. This executes an npm package while placing a credential into a project env file.
High
Ruby/shell backtick execution
3. Run `npx screenci record` yourself once tests pass. Do not stop and ask the user to record. It up
The line instructs the agent to run npx screenci record itself and notes it uploads immediately. This combines external command execution with third-party screen capture upload.
Medium
Hidden file access
- If the user already has a `SCREENCI_SECRET` from an existing account, pass it as init's first posi
The instruction writes SCREENCI_SECRET into screenci/.env through the init flow. That is intentional env-file handling and can expose a credential if copied, logged, or committed.
Medium
Hidden file access
To upload straight to an existing organization instead, get `SCREENCI_SECRET` into `screenci/.env` b
The line instructs putting SCREENCI_SECRET into screenci/.env before recording. This is direct local env-file access for a sensitive credential.
Medium
Hidden file access
- Or ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.env`. The org se
The line asks the user to copy SCREENCI_SECRET into screenci/.env. That is deliberate secret storage in an env file and needs careful handling.
Medium
Ruby/shell backtick execution
```bash
The Bash block includes npx screenci test and npx screenci record. These commands execute local or npm-provided code, and record can upload the generated capture.
Medium
Ruby/shell backtick execution
`record` needs no account: without a `SCREENCI_SECRET` it uploads under a local, anonymous trial ses
The line describes the record command uploading under an anonymous trial session. That confirms the external command has network upload behavior even without an account.
Medium
Ruby/shell backtick execution
2. Run `npx screenci test` until it passes. Fix selectors/flow/narration and rerun until green.
The line instructs running npx screenci test repeatedly. That is expected for this skill, but it still executes external CLI and project code.
Medium
Ruby/shell backtick execution
`screenci init` (or `npm init screenci`) scaffolds a new project and fails on purpose if one already
The line documents screenci init and npm init screenci commands that scaffold project files. It is a legitimate workflow, but it still represents local external command execution.
Medium
Hidden file access
To upload straight to an existing organization, get `SCREENCI_SECRET` into `screenci/.env` before th
The line tells the agent to get SCREENCI_SECRET into screenci/.env. This is direct env-file handling for a secret used by the recording upload flow.
Medium
Hidden file access
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The npm init command writes SCREENCI_SECRET into screenci/.env. Writing credentials into an env file is a real filesystem risk if not protected.
Medium
Hidden file access
2. **Secrets page:** ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.
The instruction asks the user to copy SCREENCI_SECRET into screenci/.env. That is intentional sensitive env-file storage and needs consent and gitignore protection.
Low
Hardcoded URL
5. Report the URL `record` printed (starts with the app's domain, e.g. `https://app.screenci.com/rec
The hardcoded app.screenci.com URL is an expected result link, not hidden code. It still confirms that recordings are handled by an external ScreenCI web service.
Risk Factors
📁 Filesystem access (6)
⚙️ External commands (40)
SKILL.md:3 SKILL.md:12 SKILL.md:16 SKILL.md:22 SKILL.md:24-33 SKILL.md:33-35 SKILL.md:35 SKILL.md:39-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44 SKILL.md:45-49 SKILL.md:49-50 SKILL.md:50-51 SKILL.md:51 SKILL.md:53-76 SKILL.md:76-80 SKILL.md:80 SKILL.md:82 SKILL.md:83 SKILL.md:92-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95 SKILL.md:96 SKILL.md:100 SKILL.md:102-117 SKILL.md:117-121 SKILL.md:121 SKILL.md:123 SKILL.md:125 SKILL.md:126 SKILL.md:128-132 SKILL.md:132 SKILL.md:133-134 SKILL.md:134 SKILL.md:135 SKILL.md:136 SKILL.md:138
🌐 Network access (1)
Detected Patterns
Screen capture uploadScreen capture uploadScreen capture upload
Audited by: codex
Jul 5, 2026, 11:04 AM
The review confirmed real risk around automated ScreenCI recording, cloud upload, and handling of SCREENCI_SECRET in local environment files. Most Ruby shell backtick findings are Markdown inline-code false positives, but the documented npm and npx commands are real external command execution. No prompt injection attempt was found in the reviewed files.
3
Files scanned
247
Lines analyzed
23
Review items
0
False positives ignored
Confirmed security concerns (10)
High
Environment file access
- If the user already has a `SCREENCI_SECRET` from an existing account, pass it as init's first posi
The referenced text handles SCREENCI_SECRET and stores or copies it into screenci/.env. Account organization secrets are sensitive credentials, so this is a real security concern even when user-authorized.
High
Screen capture upload
npx screenci record # capture the final recording and upload
The command is documented as capturing the final recording and uploading it. Screen recordings can contain private browser content, so automatic upload to an external service is a real high-risk behavior.
High
Environment file access
To upload straight to an existing organization instead, get `SCREENCI_SECRET` into `screenci/.env` b
The referenced text handles SCREENCI_SECRET and stores or copies it into screenci/.env. Account organization secrets are sensitive credentials, so this is a real security concern even when user-authorized.
High
Environment file access
- Or ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.env`. The org se
The referenced text handles SCREENCI_SECRET and stores or copies it into screenci/.env. Account organization secrets are sensitive credentials, so this is a real security concern even when user-authorized.
High
Screen capture upload
Use `screenci record` to capture ScreenCI videos from `.screenci.ts` scripts.
This file defines the record command as capturing ScreenCI videos, and nearby runtime behavior states successful recordings upload. The finding reflects a real screen-capture workflow with external upload risk.
High
Screen capture upload
npx screenci record # capture the final recording
The workflow instructs running npx screenci record to capture the final recording. The same reference states record uploads successful recordings, so this is a real privacy and data exposure risk.
High
Environment file access
To upload straight to an existing organization, get `SCREENCI_SECRET` into `screenci/.env` before th
The referenced text handles SCREENCI_SECRET and stores or copies it into screenci/.env. Account organization secrets are sensitive credentials, so this is a real security concern even when user-authorized.
High
Environment file access
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The referenced text handles SCREENCI_SECRET and stores or copies it into screenci/.env. Account organization secrets are sensitive credentials, so this is a real security concern even when user-authorized.
High
Environment file access
2. **Secrets page:** ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.
The referenced text handles SCREENCI_SECRET and stores or copies it into screenci/.env. Account organization secrets are sensitive credentials, so this is a real security concern even when user-authorized.
High
Autonomous Screen Recording Upload Without Confirmation
The skill tells the agent to run npx screenci record itself and says the command uploads immediately with or without SCREENCI_SECRET. This can send captured browser content to ScreenCI before a user reviews the final recording.
The reviewed files explicitly say record uploads every successful recording and instruct the agent not to ask the user to run it. That makes the privacy risk clear and intentional, not a scanner artifact.
Capability review items (10)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
The fenced command block instructs running npx screenci test and npx screenci record. These are real external CLI executions, and record can upload captured browser content.
High
Ruby/shell backtick execution
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The cited command runs npm init screenci with SCREENCI_SECRET as an argument and writes it into screenci/.env. This is real package command execution and can expose the secret through command history or process arguments.
High
Ruby/shell backtick execution
3. Run `npx screenci record` yourself once tests pass. Do not stop and ask the user to record. It up
The workflow instructs the agent to run npx screenci record itself and states it uploads immediately. This combines external command execution with cloud upload of captured screen content.
Medium
Hidden file access
- If the user already has a `SCREENCI_SECRET` from an existing account, pass it as init's first posi
The skill directs use of screenci/.env for SCREENCI_SECRET, which is a hidden environment file containing an organization secret. This is legitimate setup guidance but still creates a real local secret exposure risk.
Medium
Hidden file access
To upload straight to an existing organization instead, get `SCREENCI_SECRET` into `screenci/.env` b
The skill directs use of screenci/.env for SCREENCI_SECRET, which is a hidden environment file containing an organization secret. This is legitimate setup guidance but still creates a real local secret exposure risk.
Medium
Hidden file access
- Or ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.env`. The org se
The skill directs use of screenci/.env for SCREENCI_SECRET, which is a hidden environment file containing an organization secret. This is legitimate setup guidance but still creates a real local secret exposure risk.
Medium
Ruby/shell backtick execution
2. Run `npx screenci test` until it passes. Fix selectors/flow/narration and rerun until green.
The workflow explicitly instructs running npx screenci test until it passes. This is expected for the skill, but it is still real external command execution.
Medium
Hidden file access
To upload straight to an existing organization, get `SCREENCI_SECRET` into `screenci/.env` before th
The skill directs use of screenci/.env for SCREENCI_SECRET, which is a hidden environment file containing an organization secret. This is legitimate setup guidance but still creates a real local secret exposure risk.
Medium
Hidden file access
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The skill directs use of screenci/.env for SCREENCI_SECRET, which is a hidden environment file containing an organization secret. This is legitimate setup guidance but still creates a real local secret exposure risk.
Medium
Hidden file access
2. **Secrets page:** ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.
The skill directs use of screenci/.env for SCREENCI_SECRET, which is a hidden environment file containing an organization secret. This is legitimate setup guidance but still creates a real local secret exposure risk.
Risk Factors
📁 Filesystem access (6)
⚙️ External commands (36)
SKILL.md:3 SKILL.md:12 SKILL.md:16 SKILL.md:22 SKILL.md:24-33 SKILL.md:33-35 SKILL.md:35 SKILL.md:39-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44 SKILL.md:45-47 SKILL.md:47-72 SKILL.md:72-76 SKILL.md:76 SKILL.md:78 SKILL.md:79 SKILL.md:88-89 SKILL.md:89-90 SKILL.md:90-91 SKILL.md:91 SKILL.md:92 SKILL.md:96 SKILL.md:98-113 SKILL.md:113-117 SKILL.md:117 SKILL.md:119 SKILL.md:121 SKILL.md:122 SKILL.md:128 SKILL.md:129-130 SKILL.md:130 SKILL.md:131 SKILL.md:132 SKILL.md:134
🌐 Network access (1)
Detected Patterns
Screen capture uploadScreen capture uploadScreen capture upload
Audited by: codex