Versioned security assessment
Report ID: SA-C8087C39
7/8/2026, 8:29:53 AM
screenci security assessment v2
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- screenci
- Version
- v2
- Maintainer
- screenci
- Coverage
- 3 Files scanned · 258 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
11 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The audit confirms real external command, secret-handling, and screen-recording upload risks in the ScreenCI workflow. Most Ruby backtick detections are Markdown false positives, but record commands upload captured screens and SCREENCI_SECRET is written to screenci/.env. SKILL.md also contains suspicious XML-like closing tags that should be removed.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
3 Files scanned · 258 Lines analyzed
24 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 1 evidence location
Filesystem access
May read or write local files.
Observed in 6 evidence locations
Env variables
May read values from the process environment.
Not recorded by this audit
External commands
May invoke commands or programs outside the Skill.
Observed in 40 evidence locations
Capability review items (13)
High
Ruby/shell backtick execution
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The line instructs running npm init screenci@latest with SCREENCI_SECRET as an argument. This executes an npm package while placing a credential into a project env file.
High
Ruby/shell backtick execution
3. Run `npx screenci record` yourself once tests pass. Do not stop and ask the user to record. It up
The line instructs the agent to run npx screenci record itself and notes it uploads immediately. This combines external command execution with third-party screen capture upload.
Medium
Hidden file access
- If the user already has a `SCREENCI_SECRET` from an existing account, pass it as init's first posi
The instruction writes SCREENCI_SECRET into screenci/.env through the init flow. That is intentional env-file handling and can expose a credential if copied, logged, or committed.
Medium
Hidden file access
To upload straight to an existing organization instead, get `SCREENCI_SECRET` into `screenci/.env` b
The line instructs putting SCREENCI_SECRET into screenci/.env before recording. This is direct local env-file access for a sensitive credential.
Medium
Hidden file access
- Or ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.env`. The org se
The line asks the user to copy SCREENCI_SECRET into screenci/.env. That is deliberate secret storage in an env file and needs careful handling.
Medium
Ruby/shell backtick execution
```bash
The Bash block includes npx screenci test and npx screenci record. These commands execute local or npm-provided code, and record can upload the generated capture.
Medium
Ruby/shell backtick execution
`record` needs no account: without a `SCREENCI_SECRET` it uploads under a local, anonymous trial ses
The line describes the record command uploading under an anonymous trial session. That confirms the external command has network upload behavior even without an account.
Medium
Ruby/shell backtick execution
2. Run `npx screenci test` until it passes. Fix selectors/flow/narration and rerun until green.
The line instructs running npx screenci test repeatedly. That is expected for this skill, but it still executes external CLI and project code.
Medium
Ruby/shell backtick execution
`screenci init` (or `npm init screenci`) scaffolds a new project and fails on purpose if one already
The line documents screenci init and npm init screenci commands that scaffold project files. It is a legitimate workflow, but it still represents local external command execution.
Medium
Hidden file access
To upload straight to an existing organization, get `SCREENCI_SECRET` into `screenci/.env` before th
The line tells the agent to get SCREENCI_SECRET into screenci/.env. This is direct env-file handling for a secret used by the recording upload flow.
Medium
Hidden file access
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The npm init command writes SCREENCI_SECRET into screenci/.env. Writing credentials into an env file is a real filesystem risk if not protected.
Medium
Hidden file access
2. **Secrets page:** ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.
The instruction asks the user to copy SCREENCI_SECRET into screenci/.env. That is intentional sensitive env-file storage and needs consent and gitignore protection.
Low
Hardcoded URL
5. Report the URL `record` printed (starts with the app's domain, e.g. `https://app.screenci.com/rec
The hardcoded app.screenci.com URL is an expected result link, not hidden code. It still confirms that recordings are handled by an external ScreenCI web service.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (11)
RISK-001 High
Environment file access
- If the user already has a `SCREENCI_SECRET` from an existing account, pass it as init's first posi
SCREENCI_SECRET is an organization upload credential and the instruction passes it into project setup. Handling that secret in commands and env files is a real sensitive-data risk.
RISK-002 High
Screen capture upload
npx screenci record # capture the final recording and upload
The command comment says npx screenci record captures the final recording and uploads it. This can send captured application screens to an external ScreenCI service.
RISK-003 High
Environment file access
To upload straight to an existing organization instead, get `SCREENCI_SECRET` into `screenci/.env` b
The instruction handles SCREENCI_SECRET for organization uploads. The credential could be exposed through the env file or surrounding workflow.
RISK-004 High
Environment file access
- Or ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.env`. The org se
The line explicitly directs use of SCREENCI_SECRET from a secrets page. This is valid product setup, but it is still sensitive credential handling.
RISK-005 High
Screen capture upload
Use `screenci record` to capture ScreenCI videos from `.screenci.ts` scripts.
The file defines screenci record as the way to capture ScreenCI videos, and the same workflow documents upload behavior. Screen capture of app flows can include private data.
RISK-006 High
Screen capture upload
npx screenci record # capture the final recording
The command captures the final recording, and the record documentation states successful recordings upload. This is a real screen-capture upload workflow.
RISK-007 High
Environment file access
To upload straight to an existing organization, get `SCREENCI_SECRET` into `screenci/.env` before th
The line handles SCREENCI_SECRET before upload. This is a credential for organization recording uploads, so exposure would affect account resources.
RISK-008 High
Environment file access
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The line passes SCREENCI_SECRET to an npm init command and writes it into screenci/.env. Passing secrets on command lines and storing them locally is sensitive.
RISK-009 High
Environment file access
2. **Secrets page:** ask the user to copy `SCREENCI_SECRET` from their secrets page into `screenci/.
The line asks for SCREENCI_SECRET from a secrets page and stores it in screenci/.env. This is real credential handling, even if it supports a normal product workflow.
RISK-010 High
Prompt Injection Attempt Detected
SKILL.md ends with XML-like closing text "</content>" and "</invoke>" after the task reference. These tags could try to close prompt wrappers and change how the skill is interpreted.
The exact closing tags appear in the skill file and are not normal Markdown instructions. There is no explicit override command, so confidence is high but not absolute.
RISK-011 High
Autonomous Screen Recording Upload
The skill instructs the agent to run npx screenci record itself and states that it uploads immediately. This can send captured application screens to ScreenCI without a separate final confirmation.
The file directly says to run record yourself and that it uploads immediately. The record reference independently states successful recordings upload and return a ScreenCI URL.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighAutomatic recording uploadRequire explicit user confirmation immediately before npx screenci record, and state that the result uploads to ScreenCI.
- FIX-002HighSCREENCI_SECRET handlingAvoid passing secrets as command arguments. Prefer protected local environment setup and verify .env files are excluded from version control.
- FIX-003HighPrompt boundary markupRemove the stray </content> and </invoke> lines from SKILL.md to avoid prompt boundary confusion.
- FIX-004MediumExternal CLI executionPin ScreenCI CLI versions instead of using latest and document what each command changes before it runs.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable