The privacy line in skill-recorder sits on a single button. Everything captured during a recording stays on your machine until you click Analyze, and at that moment your window titles, URLs, clipboard previews, screen images, and narration text go to GitHub's cloud for Copilot to process. If you plan to point this at real work, understand that button first.
The pitch is simple. You record yourself doing a task once, Copilot reconstructs what you did as an intent plus an ordered list of steps, and the app turns that into something an agent can repeat. The output is either a Skill, meaning a SKILL.md procedure an agent runs on demand, or an Automation, which is the same procedure on a schedule or trigger.
What the recorder collects
The README points to an in-app panel titled "Records your screen and activity" and lists what it covers:
- Window tracking: active app and window switches.
- Browser URLs: the page you are on, listed as macOS only.
- Screen video: recorded by Chromium, with low-rate snapshots kept only when the screen changes or a heartbeat is due.
- Clipboard: short previews of copied text, used to tie steps together.
- Narration, optional: spoken commentary transcribed on-device by Whisper, which supports 99 languages and needs a one-time model download of about 252 MB.
The intro also mentions clicks as part of the session capture. Recording, storage, frame extraction, and transcription all run locally, and the README states that nothing leaves while you record.
The clipboard entry deserves attention, because a preview of copied text is part of the event timeline that ships on Analyze. The README is blunt about this: don't record, type, paste, show, copy, or narrate passwords, tokens, API keys, or other confidential information. The app reminds you before every recording. The README does not say whether secrets are automatically redacted from frames or clipboard previews.
What leaves on Analyze, and what the README does not say
The upload list is specific: the event timeline (window and document titles, URLs, clipboard previews), extracted screen images, and narration text. Read closely, it names extracted images rather than the full screen video, and narration text rather than audio, which fits the local frame extraction and on-device transcription described above.
Several things a security reviewer would ask about are not covered in the README. It does not say where on disk recordings are stored, how long they are kept locally, or how to delete a saved session after the fact. During a take you can discard it with a confirmation. It also does not describe how long GitHub retains the data sent for analysis. Find those answers before recording anything that touches customer systems.
Using it requires a GitHub account with Copilot access. The Copilot CLI ships with the app, and the first time you Analyze, it offers a sign-in prompt if you are not already signed in.
From one run to a reusable procedure
After analysis you review and edit the intent and steps until they read right, and only an approved analysis feeds the Skill or Automation builder. That review step is another checkpoint. The builders generalize from your single example, so the README's own illustration is that recording yourself submitting one form can teach the agent to submit all of them.
The builders also prefer the agent's native tools, with the gh CLI and web_fetch given as examples, over replaying UI clicks.
The Copilot describer and builders have a fixture-based eval suite. npm run eval scores the describer against synthetic recordings, and npm run eval:builder scores how well the skill and automation builders generalize.
Installing it without trusting a moving target
Distribution uses a pinned-source pattern. Skill Recorder ships as a source release: one command downloads a pinned Node.js runtime, builds the exact release commit locally, and adds a "Skill Recorder (Source)" app. The commit hash pins both the install script and the source it builds, and nothing is installed globally. The README links to an install guide for inspecting the script before running it.
macOS is the primary target, Windows 11 on x64 and ARM64 is supported, and there is an install command for Ubuntu. The app uses Electron under the MIT license, and building from source needs Node.js 24.
GitHub: https://github.com/microsoft/skill-recorder
Curated by Agent Palisade — practical AI for small and mid-sized businesses.
Top comments (0)