Caveat verdict

e2e-test-recorder

88
🟢 Trusted
No high-risk patterns surfaced by the deep scan — automated capability review, not behavioral proof.

Puppeteer-based browser recording tool for E2E test documentation; installs standard npm packages and records browser sessions to local video files with no external data transmission.

⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.

Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.

0
security
60
transparency
80
maintenance

Permission integrity

Installs packages at runtime — transitive dependencies are not auditable

package_install

Findings (9)

Pattern match critical

Possible hardcoded credential

SKILL.md · code · password: 'Password123!

Pattern match high

References SSH/GPG private keys

GITHUB_SETUP.md · code · ssh-key

Pattern match high

Accesses .ssh directory

GITHUB_SETUP.md · code · .ssh/

Pattern match high

<script> tag in markdown — potential code injection

scripts/record-test.js · prose · downgraded · <script>

Pattern match high

Uses eval() — can execute arbitrary code

scripts/utils.js · prose · downgraded · eval(

Pattern match medium

References child_process — can spawn system processes

scripts/auto-release.js · prose · downgraded · child_process

Pattern match medium

setuid — privilege escalation mechanism

scripts/record-browser.js · prose · downgraded · setuid

Pattern match low

Accesses sensitive environment variables

scripts/auto-release.js · prose · downgraded · process.env.GITHUB_TOKEN

Pattern match low

Node http/https module — low-level network access

scripts/github-api-release.js · prose · downgraded · require('https')

Why the tier is capped

Execution sink present in raw bytes (Hard Floor: class D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.

Permissions & capabilities

No declared permissions — minimal attack surface.

package_installnetwork_in

Is this flag fair?

Check another skill Browse the registry Auditing your own skills or configs? Use the API