media-matte

Pass

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The driver script scripts/matte.py utilizes subprocess.run to invoke external command-line utilities.
  • Evidence: The script executes rembg, ffmpeg, and the RVM inference.py script to perform background removal and video compositing. Commands are passed as lists of arguments, and shell execution is avoided to prevent injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill references external code and assets from well-known services.
  • Evidence: Instructions in SKILL.md recommend cloning the RobustVideoMatting repository from GitHub and installing several machine learning packages from PyPI using uv or pip.
  • Evidence: The skill downloads model weights and configuration files from HuggingFace repositories.
  • [REMOTE_CODE_EXECUTION]: The skill utilizes a model loading mechanism that allows for remote code execution from a well-known service.
  • Evidence: The Python inference logic for the briaai/RMBG-2.0 and ZhengPeng7/BiRefNet models uses the trust_remote_code=True parameter within the HuggingFace transformers library. This is used to execute model-specific segmentation logic provided by the model authors.
  • Evidence: The driver script contains embedded Python snippets (BIREFNET_INLINE, REFINE_INLINE, COMPOSITE_INLINE) that are executed via python -c. These snippets are static and facilitate modular inference without imposing full ML dependencies on the primary driver.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 27, 2026, 09:54 AM
Security Audit — agent-trust-hub — media-matte