Skills
skills/aradotso/claude-code-skills/arcads-ai-video-generation/Gen Agent Trust Hub

arcads-ai-video-generation

Fail

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions prompt the agent to clone a repository from an unverified third-party GitHub account (krusemediallc/arcads-claude-code) to access the skill's core scripts and templates.
  • [REMOTE_CODE_EXECUTION]: Users are directed to execute a local shell script (./scripts/setup.sh) after cloning, which runs arbitrary and unvetted code from the external repository on the user's system.
  • [COMMAND_EXECUTION]: The skill frequently utilizes subprocess.run to execute external binaries like ffmpeg, jq, and node, as well as various internal generator scripts within the cloned project.
  • [EXTERNAL_DOWNLOADS]: The installation process involves downloading system-level packages via brew and Python dependencies via pip from multiple sources, including unvetted local requirements files.
  • [DATA_EXFILTRATION]: While intended, the skill transmits user-provided prompts and image data to an external API (api.arcads.ai). Users should be aware that sensitive media and instructions are shared with this third-party service.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 14, 2026, 12:29 AM
Security Audit — agent-trust-hub — arcads-ai-video-generation