creativeclaw
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to install local development tools from well-known sources during the setup process.
- Fetches and executes the
uvinstallation script fromastral.sh, which is the official domain of a well-known Python tooling vendor. - Downloads static FFmpeg and FFprobe binaries for macOS from
evermeet.cx, the community source officially recommended byffmpeg.orgfor static builds. - [COMMAND_EXECUTION]: Multiple Python helper scripts contained within the skill execute shell commands to perform video and audio processing.
- Scripts such as
render.py,grade.py, andprepare_audio.pyutilizesubprocess.runto callffmpegfor trimming, color grading, and audio extraction. - The installation workflow utilizes the
xattrcommand to manage Gatekeeper flags on the downloaded FFmpeg binary, which is a standard procedure for this environment setup. - [EXTERNAL_DOWNLOADS]: A media processing helper script (
smart_vertical.py) is designed to automatically download a required machine learning model. - The script fetches a face detection ONNX model from the official
opencvorganization's public repository on GitHub. - [DATA_EXFILTRATION]: The skill provides automated brand extraction workflows that scrape information from user-specified websites.
- It utilizes browser-based tools to capture CSS color variables, logo image URLs, and font family names to populate the studio's brand theme configuration.
Audit Metadata