[Low] Hardening backlog: 7 low-severity findings from the code audit

[adilei]

Tracking issue for the 7 low-severity / informational findings from the full-codebase audit. Grouped to keep the tracker tidy; each can be split out if picked up individually. All are deterministic and belong under npm test (the evals/ suites don't apply).

L1 — allowed-tools YAML items emitted unescaped

common/skill.ts:230 renders each tool as - ${t} with no quoting/escaping. A tool token containing YAML metacharacters could break or inject into the SKILL.md frontmatter. Fix: quote/escape tool tokens (or validate them against an allowed charset). Test: render with a metacharacter-laden token; assert valid YAML.

L2 — Frame manifest paths read without ../absolute rejection

electron/describer/tools.ts:256 reads frame paths from the manifest without containment-checking them against the frames dir. Fix: reject ../absolute paths (reuse the isInside pattern). Test: manifest with a traversal path is refused.

L3 — Session id sourced from file contents, not the validated dir name

electron/sessions.ts:158 returns id: meta.id (from session.json) rather than the validated directory name. A tampered session.json could spoof the id. Fix: return the validated directory name. Test: mismatched meta.id vs dir name resolves to the dir name.

L4 — Analysis proceeds silently after transcription failure (informational)

electron/ipc.ts:136 continues to analysis when transcription fails (documented best-effort). Consider: surfacing a soft, non-blocking warning so users know narration was unavailable. Test: optional.

L5 — Whisper model not version-pinned / hash-verified

electron/narration/whisper.ts fetches Xenova/whisper-small without pinning a revision or verifying a hash (contrast: Node/Electron downloads in the installers are SHA-256 pinned). Fix: pin a revision + verify. Pairs with the Medium "readiness is existence-only" issue.

L6 — Partial ffmpeg outputs left on failure

electron/frames/extractor.ts (~340–362, ~393–410) leaves probe_* partial outputs when ffmpeg fails. Fix: clean up partial files in the catch. Pairs with the Medium "ffmpeg no timeout" issue. Test: failed extraction leaves no probe_* residue.

L7 — Governance: personal namespace + unpinned source archive

Installers, README.md, INSTALL.md, and package.json#repository point at adilei/skill-recorder (a personal namespace) for a repo published under microsoft/; the downloaded source archive is not hash-pinned (Node/Electron are). Fix: repoint references to microsoft/skill-recorder and pin/verify the source archive.

[adilei]

L6 (partial ffmpeg outputs left on failure) is resolved by #69 on release/0.6.0. The legacy system-ffmpeg fallback was removed entirely, eliminating both partial outputs and the unbounded child-process path from #14.