asset-import

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses node to run bundled helper scripts for media management.
  • serve-local-media.mjs: Starts a short-lived (900s) local HTTP server on 127.0.0.1 to stream files to the editor. It uses a 128-bit random token and origin validation to ensure only the authorized editor can access the files.
  • upload-media.mjs: Executes ffmpeg and ffprobe to transcode and analyze media files before uploading them to the ChatCut endpoint. It handles multi-part uploads and generates thumbnails.
  • [REMOTE_CODE_EXECUTION]: While the skill executes local scripts, it does not download or execute arbitrary code from the internet. All logic is contained within the skill's distributed files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 11:53 AM