bggg-tiktok-readvideo
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes system utilities (
ffmpeg,ffprobe,whisper-cli,tesseract) viasubprocess.runto perform media processing. These calls are implemented using list-based arguments, which is a secure practice that prevents shell injection vulnerabilities. - [SAFE]: The skill operates entirely on local files and does not exhibit any network communication or data exfiltration behavior.
- [SAFE]: Project directories and output filenames are sanitized using robust slugification and safe-naming logic to prevent path traversal issues.
- [SAFE]: The skill transforms untrusted video data (via transcription and OCR) into markdown context for the agent. While this presents an indirect prompt injection surface, the skill follows established patterns by structuring the data into defined assets (metadata, scenes, timeline) for the agent to read, rather than executing the content.
Audit Metadata