creativeclaw

Pass

Audited by Gen Agent Trust Hub on May 6, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill includes instructions to install local development tools from well-known sources during the setup process.
  • Fetches and executes the uv installation script from astral.sh, which is the official domain of a well-known Python tooling vendor.
  • Downloads static FFmpeg and FFprobe binaries for macOS from evermeet.cx, the community source officially recommended by ffmpeg.org for static builds.
  • [COMMAND_EXECUTION]: Multiple Python helper scripts contained within the skill execute shell commands to perform video and audio processing.
  • Scripts such as render.py, grade.py, and prepare_audio.py utilize subprocess.run to call ffmpeg for trimming, color grading, and audio extraction.
  • The installation workflow utilizes the xattr command to manage Gatekeeper flags on the downloaded FFmpeg binary, which is a standard procedure for this environment setup.
  • [EXTERNAL_DOWNLOADS]: A media processing helper script (smart_vertical.py) is designed to automatically download a required machine learning model.
  • The script fetches a face detection ONNX model from the official opencv organization's public repository on GitHub.
  • [DATA_EXFILTRATION]: The skill provides automated brand extraction workflows that scrape information from user-specified websites.
  • It utilizes browser-based tools to capture CSS color variables, logo image URLs, and font family names to populate the studio's brand theme configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
May 6, 2026, 11:39 AM
Security Audit — agent-trust-hub — creativeclaw