Default screen recording may capture sensitive content and auto-post it when Slack thread context is present
Source references: 5Agents are told to record the full reproduction by default. If Slack channel and thread context is merely provided, the instructions require posting the recording there without obtaining a separate explicit publishing approval. Although another rule prohibits private details, recording happens before review or redaction, so transient dialogs, notifications, account data, and internal URLs may still enter the video.
The recording could expose customer data, internal interfaces, notifications, or session information to channel members who should not see it. Once uploaded, it may also be retained, downloaded, or forwarded under Slack policies.
The skill records the reproduction by default and directs the agent to post the recording when a Slack channel and thread are present; that condition does not also require a separate explicit posting authorization. The express prohibition on private details reduces the risk, but recordings can still inadvertently capture notifications, account information, or private URLs before being uploaded. This risk applies only when Slack thread context is supplied and posting is available. Users can require human review/redaction before upload and keep thread identification separate from authorization to post.
- Reproduce the reported behavior as faithfully as possible.- Capture a screen recording of the reproduction by default; most UI bugs involve motion, a transition, or a multi-step interaction, so a clip is stronger proof than stills. Capture screenshots as a supplement, or as the primary artifact only for a genuinely static render.- If the provided steps are unclear or incomplete, use codebase and product knowledge to identify plausible app states that could produce the reported behavior, then test the assigned hypothesis.Show 4 other places
- Do not ask the public reporter for credentials, tokens, private repos, private workspace names, or private account identifiers.- Do not include secrets, auth tokens, private URLs, Authorization headers, refresh tokens, or other private account details in recordings, screenshots, logs, manifests, or final reports.- Do not create or sign into an account unless the prompt and repository-specific guidance explicitly authorize a safe test-auth workflow.- If the assigned report cannot be exercised within the allowed auth/state constraints, stop and report the blocker.- Do not post comments to GitHub, Linear, or external services unless explicitly instructed. When a Slack thread context is provided (a channel id and thread), post the reproduction proof (the recording) back to that thread so the requester sees it; do not post to any other channel or service.- Avoid destructive actions. If a repro requires deleting app state, delete only test state for the current repro environment and report exactly what was reset.- Create a dedicated artifact directory named for your variant, such as `~/bug-repro-primary`.- Record a screen recording of the reproduction by default and save it in the artifact directory with a descriptive name such as `repro.mp4`.- Capture screenshots as a supplement (or as the primary artifact only for a genuinely static render) with ordered filenames, such as `01-initial-state.png`, `02-before-click-settings.png`, and `03-after-click-settings.png`. - whether the screenshot shows the reported bug- If the harness supports built-in screenshot or artifact upload, use it. Otherwise leave artifacts in the directory and report the paths.- If the assigned report cannot be exercised within the allowed auth/state constraints, stop and report the blocker.- Do not post comments to GitHub, Linear, or external services unless explicitly instructed. When a Slack thread context is provided (a channel id and thread), post the reproduction proof (the recording) back to that thread so the requester sees it; do not post to any other channel or service.- Avoid destructive actions. If a repro requires deleting app state, delete only test state for the current repro environment and report exactly what was reset.