media-interpolate

Pass

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/interp.py driver script executes ffmpeg, ffprobe, and rife-ncnn-vulkan to perform video extraction, interpolation, and remuxing. It uses Python's subprocess.run with list-based arguments and shlex.quote for logging, which effectively prevents shell injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions and URLs for downloading official binaries and cloning repositories for RIFE, FILM, and PractCL. These resources are from established open-source projects (e.g., Google Research) and are necessary for the skill's primary functionality.
  • [PROMPT_INJECTION]: The skill processes untrusted media files provided by the user, which represents a potential surface for indirect prompt injection.
  • Ingestion points: Input video and image paths are accepted through the CLI in scripts/interp.py via the --in, first, and second arguments.
  • Boundary markers: The skill does not explicitly use boundary markers for these inputs, but the processing is focused on binary data rather than text parsing.
  • Capability inventory: The skill possesses the capability to write to the local filesystem and execute subprocesses (ffmpeg).
  • Sanitization: Input paths are treated as strings and passed to system commands using secure subprocess lists, minimizing the risk of command-level injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 27, 2026, 09:54 AM
Security Audit — agent-trust-hub — media-interpolate