Versioned security assessment

Report ID: SA-EBDFE608

7/23/2026, 7:40:55 PM

screenci security assessment v3

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
screenci
Version
v3
Maintainer
screenci
Source
github.com/screenci/screenci/tree/main/skills/screenci/
Coverage
3 Files scanned · 258 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

7 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill intentionally runs ScreenCI commands and uploads browser recordings to an external service. Most shell findings are Markdown or API references, but actual npm and npx commands, command-line secret handling, and upload behavior are confirmed risks. The unmatched prompt-wrapper closing tags and the instruction to upload without confirmation add high-confidence semantic concerns.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

3 Files scanned · 258 Lines analyzed

11 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 1 evidence location

Filesystem access

May read or write local files.

Observed in 6 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 40 evidence locations

Capability review items (4)
High
SKILL.md:125
Ruby/shell backtick execution
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The line instructs execution of npm init screenci@latest with a secret argument. It runs external package code while exposing a credential on the command line.
High
SKILL.md:134
Ruby/shell backtick execution
3. Run `npx screenci record` yourself once tests pass. Do not stop and ask the user to record. It up
The instruction requires the agent to run npx screenci record. The command captures browser content and immediately uploads it.
Medium
SKILL.md:24-33
Ruby/shell backtick execution
```bash
The fenced block contains npx screenci test and record commands. These commands execute an external package and can start browser automation or upload.
Medium
SKILL.md:133-134
Ruby/shell backtick execution
2. Run `npx screenci test` until it passes. Fix selectors/flow/narration and rerun until green.
The instruction requires repeated execution of npx screenci test. This launches third-party package code and local browser automation.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (7)

RISK-001 High
references/init.md:41
Environment file access
- If the user already has a `SCREENCI_SECRET` from an existing account, pass it as init's first posi
The instruction passes SCREENCI_SECRET as an initializer argument before writing it to screenci/.env. Command-line arguments can expose the shared credential through shell history or process inspection.
RISK-002 High
references/init.md:54
Screen capture upload
npx screenci record # capture the final recording and upload
The command explicitly captures the final browser recording and uploads it. Recorded pages can contain private or authenticated information.
RISK-003 High
references/record.md:3
Screen capture upload
Use `screenci record` to capture ScreenCI videos from `.screenci.ts` scripts.
The command captures browser activity, and the same workflow uploads every successful recording. Screen content can include sensitive application data.
RISK-004 High
references/record.md:55
Screen capture upload
npx screenci record # capture the final recording
The final command starts ScreenCI recording, whose documented runtime behavior includes upload. This creates a direct external disclosure risk for captured content.
RISK-005 High
SKILL.md:125
Environment file access
1. **Pass it to init:** `npm init screenci@latest <SCREENCI_SECRET> -- --yes` writes it into `screen
The command places SCREENCI_SECRET in a process argument and gives it to an unpinned initializer. This can expose a shared organization credential.
RISK-006 High
SKILL.md:134
Unconfirmed Screen Recording Upload
The skill says, "Do not stop and ask the user to record. It uploads immediately." This bypasses confirmation before browser content leaves the device.
The instruction explicitly requires immediate upload and discourages pausing for user action. The behavior can disclose authenticated pages or private data.
RISK-007 High
SKILL.md:143-144
Prompt Injection Attempt Detected
The file ends with unmatched "</content>" and "</invoke>" tags. These tags can terminate prompt wrappers and alter how following instructions are interpreted.
The closing tags have no matching opening tags or ScreenCI purpose. Their wrapper-like names strongly indicate an attempted prompt-boundary escape.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    The workflow uploads screen recordings without requesting confirmation.
    Require explicit user approval immediately before recording and upload. Tell users what will leave the device and review flows for private data.
  2. FIX-002
    High
    The initializer receives SCREENCI_SECRET as a command-line argument.
    Use a masked prompt or protected environment input instead. Never place the shared organization secret in shell history or process arguments.
  3. FIX-003
    High
    SKILL.md ends with unmatched prompt-wrapper closing tags.
    Remove the standalone closing tags and keep the file as ordinary skill documentation.
  4. FIX-004
    Medium
    The workflow executes npm and npx packages without a pinned version.
    Pin a reviewed ScreenCI package version and require confirmation before first execution or after any version change.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
Content hash
71545a536187a4b4945477786aedbf325bac52c39dc4e62061120c60b1cbcac1
Tree hash
9815fd18240a5119c95aad31a865f97df449a347918ce4d1e80cc5a985a46ba1
Skill path
skills/screenci/screenci
Audit payload hash
253cfd31fce7c38ced4e1e6e651aa144

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active