asset-import
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
nodeto run bundled helper scripts for media management. serve-local-media.mjs: Starts a short-lived (900s) local HTTP server on127.0.0.1to stream files to the editor. It uses a 128-bit random token and origin validation to ensure only the authorized editor can access the files.upload-media.mjs: Executesffmpegandffprobeto transcode and analyze media files before uploading them to the ChatCut endpoint. It handles multi-part uploads and generates thumbnails.- [REMOTE_CODE_EXECUTION]: While the skill executes local scripts, it does not download or execute arbitrary code from the internet. All logic is contained within the skill's distributed files.
Audit Metadata