Open the README with an explainer video

CHANGELOG.md

@@ -6,6 +6,7 @@ and two reports are only comparable when it matches or the difference is known.
 
 ## Unreleased
 
+- The README opens with a 63-second explainer video: what the probe measures, the `python:3.12-slim` hardening scores, the Antigravity CLI 1.5.2 and `srt` 0.0.81 measurements, and the Harbor grader control task, with each figure taken from a report in `examples/`.
 - Antigravity CLI 1.5.2 measured, with writes and proxy traffic tested for real by `scripts/check_sandbox_boundaries.py`. Under `--sandbox`, `--dangerously-skip-permissions` now leaves the home directory, its shell startup files and the project writable and scores 100, and the 1.5.1 proxy still accepts tunnels to any hostname. With `proceed-in-sandbox` the score stays 31 and the working directory stays read-only, while files written to the build caches it leaves writable, including `~/.cargo/bin`, persist on the host. `measure_stubbed_agent.py` gains `--script` to run a check in place of the probe.
 - Anthropic's sandbox runtime, `srt` 0.0.81, measured on macOS in four configurations. With `allowWrite ["."]` it leaves Claude Code's project settings files writable, which its documentation describes, and naming them in `denyWrite` protects them.
 

README.md

@@ -1,5 +1,7 @@
 # agentsec-pack
 
+https://github.com/user-attachments/assets/6a83df69-a2a6-4b16-8984-465fac7d6cd9
+
 Installed with `pip install agentsec-pack`, the `agentsec` command measures what an AI agent could reach from inside its sandbox across the network, secrets, the host filesystem, privileges and the other processes on the machine. The sandbox sets the limit on damage because a prompt-injected or mistaken agent can do whatever its sandbox allows. A transcript shows what the agent did, and this tool measures what the sandbox would have let it do.
 
 A small standard-library Python probe inside the sandbox opens credential files, connects to hosts and sockets, writes zero-byte marker files, and reports secret names and paths without values. Refused connections count as contained, and a control test checks whether refusals apply to the entire system call or one path. A scorer turns results into findings with fixed weights and a score from 0 to 100, where 0 means the probe reached nothing. The `--max-score` flag fails a CI build above a budget, `--baseline` fails when anything got worse than an accepted report, and both exit with code 2.