ffmpeg-mxf-imf

Pass

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a Python script (scripts/mxfimf.py) to wrap ffmpeg and ffprobe commands. The script safely executes these binaries by passing arguments as a list to subprocess.call() and subprocess.check_output(), which prevents shell injection attacks. An internal _shquote function is used solely for descriptive logging purposes, not for command construction.
  • [EXTERNAL_DOWNLOADS]: The documentation references Netflix's official 'Photon' repository on GitHub for IMF validation. This reference is to a well-known and reputable industry tool and does not involve automated downloads or execution of untrusted code.
  • [DATA_EXFILTRATION]: No patterns of sensitive data access or exfiltration were detected. The skill focuses entirely on local media file transformations.
  • [PROMPT_INJECTION]: The instructions are strictly technical and instructional. No attempts to override agent behavior, bypass safety filters, or extract system prompts were found.
  • [DYNAMIC_EXECUTION]: The Python script performs standard parsing of ffprobe JSON output to identify stream properties. It does not use eval(), exec(), or any other dynamic code execution methods on untrusted data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 27, 2026, 09:53 AM
Security Audit — agent-trust-hub — ffmpeg-mxf-imf